mporwoll/cms.c2sgmbh
1
0
Fork 0
mirror of https://github.com/complexcaresolutions/cms.c2sgmbh.git synced 2026-03-17 23:14:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
101 commits 17 branches 0 tags 17 MiB
Commit graph

6 commits

Author SHA1 Message Date
Martin Porwoll
63b97c14f2 feat(security): enhance CSRF, IP allowlist, and rate limiter with strict production checks 
- CSRF: Require CSRF_SECRET in production, throw error on missing secret
- IP Allowlist: TRUST_PROXY must be explicitly set to 'true' for proxy headers
- Rate Limiter: Add proper proxy trust handling for client IP detection
- Login: Add browser form redirect support with safe URL validation
- Add custom admin login page with styled form
- Update CLAUDE.md with TRUST_PROXY documentation
- Update tests for new security behavior

BREAKING: Server will not start in production without CSRF_SECRET or PAYLOAD_SECRET

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2025-12-18 05:06:15 +00:00
Martin Porwoll
57fe652dfa fix: support Payload Admin Panel multipart/form-data login format 
The Payload Admin Panel sends login credentials as a _payload JSON field
within multipart/form-data, not as separate email/password fields.
This fix adds support for parsing the _payload field while maintaining
backwards compatibility with direct FormData fields and JSON body.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-09 08:46:45 +00:00
Martin Porwoll
2fae62eaf3 fix: apply CSRF protection and centralize rate limiting 
- Migrate /api/posts from legacy checkRateLimit to central searchLimiter
- Add IP blocklist check and rateLimitHeaders to /api/posts
- Apply CSRF validation to /api/send-email (POST)
- Apply CSRF validation to /api/users/login (POST)
- Apply CSRF validation to /api/auth/login (POST)

CSRF protection uses the Double Submit Cookie pattern which:
- Skips safe methods (GET, HEAD, OPTIONS)
- Allows server-to-server requests with Authorization header
- Validates Origin header for browser requests
- Requires matching tokens in header and cookie for browser POSTs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 23:47:07 +00:00
Martin Porwoll
cb2e903db5 fix: integrate security modules into actual endpoints 
Rate Limiting Integration:
- Add authLimiter (5 attempts/15min) to both login routes for brute-force protection
- Migrate search endpoints from local checkRateLimit to central searchLimiter
- Add IP blocklist checks to auth and search endpoints

Data Masking Integration:
- Integrate maskObject/maskString from security module into audit-service
- Auto-mask previousValue, newValue, metadata, and descriptions in audit logs
- Use maskError for error logging

Pre-commit Hook:
- Add "prepare" script to package.json for automatic hook installation
- Hook is now installed automatically on pnpm install

Note: CSRF middleware is available but not enforced on API routes since
Payload CMS uses JWT auth and has built-in CORS/CSRF protection in config.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 23:34:08 +00:00
Martin Porwoll
47d912016b fix: eliminate duplicate audit entries and add proper client context 
- Extend logLoginFailed to accept ClientInfo directly (not just PayloadRequest)
- Add logPasswordReset function for password reset audit logging
- Remove duplicate manual payload.create calls in login routes
- Implement real fallback in auditAfterForgotPassword with structured JSON log
- Login routes now create single audit entry with full IP/User-Agent context

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 22:07:52 +00:00
Martin Porwoll
dfb35566b7 fix: correct auth audit logging - use args.req.payload and override native login 
- Fix afterForgotPassword hook to read payload from args.req.payload instead of context
- Create /api/users/login route to override native Payload login endpoint
- Add IP/User-Agent context to failed login audit entries
- Update /api/auth/login with consistent client info logging

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 22:00:36 +00:00