Dave Kempe 2187cfc1e4 Security hardening: 5 fixes from audit ...

- Vault TLS: replace hardcoded danger_accept_invalid_certs(true) with
  configurable tls_skip_verify option (default: false)
- Share tokens: use constant-time SHA-256 hash comparison to prevent
  timing side-channel attacks
- OIDC pending states: add 10-minute TTL, evict stale entries on each
  login to prevent unbounded HashMap growth
- Recording path traversal: add canonical path validation as defense-
  in-depth alongside existing string checks
- Frontend XSS: escape all user-controlled data (filenames, paths) in
  innerHTML via escapeHtml/escapeAttr in client.html and recordings.html

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-07 11:34:54 +11:00

..

guac

Initial public release

2026-02-06 14:38:53 +11:00

403.http

Initial public release

2026-02-06 14:38:53 +11:00

addressbook.html

Initial public release

2026-02-06 14:38:53 +11:00

admin.html

Initial public release

2026-02-06 14:38:53 +11:00

client.html

Security hardening: 5 fixes from audit

2026-02-07 11:34:54 +11:00

docs.html

Initial public release

2026-02-06 14:38:53 +11:00

index.html

Initial public release

2026-02-06 14:38:53 +11:00

logo.svg

Initial public release

2026-02-06 14:38:53 +11:00

recordings.html

Security hardening: 5 fixes from audit

2026-02-07 11:34:54 +11:00

sessions.html

Initial public release

2026-02-06 14:38:53 +11:00