WA Dev Tools - набор веб-инструментов для разработчиков
treamz
5c7066b7d3
Security hardening: helmet, rate limits, session fixes, admin auth
Critical fixes:
- helmet middleware (X-Frame-Options, HSTS, X-Content-Type, CSP, etc)
- Remove /admin from PUBLIC_PREFIXES (double auth: session + admin role)
- Session cookie: httpOnly, sameSite=lax, 1-day expiry (was 30 days)
- Session regeneration on login (prevent session fixation)
- Blocked user check on login
Rate limiting:
- /auth/login: 10 req / 15 min (brute force protection)
- /auth/register: 10 req / 15 min (spam protection)
- /parse, /metadata, /text, /preview: 20 req / min (DDoS via server)
Input sanitization:
- Strip HTML tags from display_name (stored XSS prevention)
|
2026-03-22 00:39:38 +03:00 |
|
.adminjs
|
Dynamic content: landing and dashboard load texts from DB via API
|
2026-03-21 23:53:37 +03:00 |
|
lib
|
Security hardening: helmet, rate limits, session fixes, admin auth
|
2026-03-22 00:39:38 +03:00 |
|
public
|
Status page: public monitoring at /status
|
2026-03-22 00:35:15 +03:00 |
|
routes
|
Security hardening: helmet, rate limits, session fixes, admin auth
|
2026-03-22 00:39:38 +03:00 |
|
.gitignore
|
Initial commit: WA Dev Tools service
|
2026-03-21 22:06:15 +03:00 |
|
ecosystem.config.js
|
Refactor: modular architecture, security, config
|
2026-03-21 22:18:54 +03:00 |
|
EDITOR-DOC.md
|
Initial commit: WA Dev Tools service
|
2026-03-21 22:06:15 +03:00 |
|
package-lock.json
|
Security hardening: helmet, rate limits, session fixes, admin auth
|
2026-03-22 00:39:38 +03:00 |
|
package.json
|
Security hardening: helmet, rate limits, session fixes, admin auth
|
2026-03-22 00:39:38 +03:00 |
|
server.js
|
Security hardening: helmet, rate limits, session fixes, admin auth
|
2026-03-22 00:39:38 +03:00 |
|
SVGEDITOR-FEATURES.md
|
Initial commit: WA Dev Tools service
|
2026-03-21 22:06:15 +03:00 |