treamz 5c7066b7d3 Security hardening: helmet, rate limits, session fixes, admin auth ... Critical fixes: - helmet middleware (X-Frame-Options, HSTS, X-Content-Type, CSP, etc) - Remove /admin from PUBLIC_PREFIXES (double auth: session + admin role) - Session cookie: httpOnly, sameSite=lax, 1-day expiry (was 30 days) - Session regeneration on login (prevent session fixation) - Blocked user check on login Rate limiting: - /auth/login: 10 req / 15 min (brute force protection) - /auth/register: 10 req / 15 min (spam protection) - /parse, /metadata, /text, /preview: 20 req / min (DDoS via server) Input sanitization: - Strip HTML tags from display_name (stored XSS prevention)		2026-03-22 00:39:38 +03:00
..
admin.js	Admin SSO: shared session with main site	2026-03-22 00:00:13 +03:00
auth.js	Security hardening: helmet, rate limits, session fixes, admin auth	2026-03-22 00:39:38 +03:00
db.js	Auth + Landing + Categories	2026-03-21 22:54:31 +03:00
logger.js	Refactor: modular architecture, security, config	2026-03-21 22:18:54 +03:00
ssrf.js	Refactor: modular architecture, security, config	2026-03-21 22:18:54 +03:00