vacuum-wall

Files

T

mteehan a365059976 security: harden JWT auth with session binding, CSP headers, and sessionStorage

- Reduce access_token_ttl from 900s to 300s (5 min) to shrink XSS exploit window
- Add session_id claim to JWT tokens tied to browser session (X-Session-Id header)
- Flask middleware validates session_id matches header on every request
- CSP headers: default-src/script-src 'self', no unsafe-inline/eval, frame-ancestors none
- X-Content-Type-Options: nosniff on all responses
- Move refresh token from localStorage to sessionStorage (tab-scoped, cleared on close)
- Timing-safe password verification (dummy Argon2id for unknown users)
- WebSocket auth also validates session_id header
- Add 5 session_id tests and 3 CSP header tests

2026-07-24 03:09:07 +00:00

__init__.py

refactor: introduce two-user daemon architecture with socket-based communication

2026-05-27 23:39:33 +00:00

acme.py

feat: auto-generate self-signed certs, hoover modal processing guard, refactor backends/proxy pages

2026-07-13 14:30:35 +00:00

auth.py

security: harden JWT auth with session binding, CSP headers, and sessionStorage

2026-07-24 03:09:07 +00:00

dnsmasq.py

fix: critical bugs + security hardening