codegirl007/plumber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden auth: setup secret, throttling, session destroy, secure cookies.

Browse Source 
Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.
This commit is contained in:
codegirl007
2026-08-22 11:47:42 -07:00
parent 96b0ce795a
commit 59513ab75e
9 changed files with 287 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+7 -4
View File
@@ -5,11 +5,14 @@ LISTEN=:8080
DATABASE_URL=postgresql://user:password@host.example.com:5432/postgres?sslmode=verify-full
# Required for integration tests (do not point at the runtime DATABASE_URL).
# TEST_DATABASE_URL=postgresql://user:password@host.example.com:5432/plumber_test?sslmode=verify-full
# Optional: first matching registrant becomes admin only if no admin exists yet.
# Later promote/demote via /admin/users (admins only).
ADMIN_USERNAME=yourusername
# Set to 1 when serving over HTTPS
# One-time first-admin bootstrap: registrant must also POST setup_secret matching this value,
# and only while no admin exists yet. Leave unset after bootstrap. Prefer a long random string.
# ADMIN_SETUP_SECRET=
# When PORT is set (App Platform), cookies are Secure by default; SECURE_COOKIE=0 is rejected.
# Locally, set to 1 when serving over HTTPS:
SECURE_COOKIE=0
# Set to 1 only behind a trusted reverse proxy that sets X-Forwarded-For.
# TRUST_PROXY=0
# DigitalOcean Spaces (profile avatars). Leave unset to disable uploads.
# SPACES_KEY=
# SPACES_SECRET=