 Pulse Monitor
|
565573ac40
|
feat: enhance security and improve API token UX
Security Improvements:
- Add comprehensive CSRF protection for state-changing operations
- Implement rate limiting (500 req/min general, 10/min for auth)
- Add account lockout after 5 failed login attempts
- Secure session management with HttpOnly cookies
- Add security headers (CSP, X-Frame-Options, etc.)
- Implement audit logging for security events
- Session invalidation on password change
API Token UX Improvements:
- Always show API token to authenticated users (no longer hide after generation)
- Add ability to view existing token anytime from Settings
- Fix clipboard copy with HTTP fallback
Authentication Flow Fixes:
- Fix WebSocket initialization to occur after auth check
- Fix CSRF validation to handle server restarts gracefully
- Adjust rate limiting to exclude high-frequency endpoints
- Fix authentication check to use session cookies properly
Documentation Updates:
- Document all security features comprehensively
- Update API documentation with CSRF usage examples
- Add security feature details to README
|
2025-08-13 19:05:23 +00:00 |
|