3 Commits

Author	SHA1	Message	Date
Pulse Monitor	15682557c7	fix: support authentication through Cloudflare tunnels and reverse proxies (#325) ... - Detect when running behind a proxy/tunnel (X-Forwarded-*, CF-Ray headers) - Use SameSite=None for cookies when proxied to allow cross-origin access - Properly detect HTTPS when behind proxy using X-Forwarded-Proto - Fixes authentication not working through Cloudflare tunnels The issue was that SameSite=Strict/Lax cookies don't work when the origin changes (which happens with tunnels/proxies). Now we detect proxy headers and relax the cookie policy to SameSite=None when needed.	2025-08-17 18:11:47 +00:00
Pulse Monitor	a01dff8514	fix: resolve WebSocket metric updates and improve polling efficiency ... - Fix alternating zero I/O metrics by implementing rate caching for stale data from Proxmox - Hardcode polling interval to 10 seconds (matching Proxmox cluster/resources update cycle) - Remove polling interval settings from UI (no longer user-configurable) - Implement efficient VM/container polling using single cluster/resources API call - Remove 'Remove Password' feature (auth is now mandatory) - Fix CSRF validation for Basic Auth (exempt from CSRF checks) - Fix Generate API Token modal and authentication - Remove redundant 'Active' status from Authentication section - Remove Connection Timeout setting from frontend (backend-only) - Clean up frontend console logging (reduce verbosity) - Remove PBS polling interval setting (fixed at 10s) - Add frontend rebuild detection to backend-watch script - Improve first-run setup flow and error handling	2025-08-16 12:12:10 +00:00
Pulse Monitor	35b51c3a77	feat: enhance security and improve API token UX ... Security Improvements: - Add comprehensive CSRF protection for state-changing operations - Implement rate limiting (500 req/min general, 10/min for auth) - Add account lockout after 5 failed login attempts - Secure session management with HttpOnly cookies - Add security headers (CSP, X-Frame-Options, etc.) - Implement audit logging for security events - Session invalidation on password change API Token UX Improvements: - Always show API token to authenticated users (no longer hide after generation) - Add ability to view existing token anytime from Settings - Fix clipboard copy with HTTP fallback Authentication Flow Fixes: - Fix WebSocket initialization to occur after auth check - Fix CSRF validation to handle server restarts gracefully - Adjust rate limiting to exclude high-frequency endpoints - Fix authentication check to use session cookies properly Documentation Updates: - Document all security features comprehensively - Update API documentation with CSRF usage examples - Add security feature details to README	2025-08-13 19:05:23 +00:00