aab448b076
Clarify web UI terminology, copy, and the entrypoint URL ( closes #57 )
...
check / check (push) Successful in 4s
Unifies user-visible copy on "Webhook" (routes and URLs unchanged), drops
the placeholder Profile settings section, and adds a copy-to-clipboard
affordance for the entrypoint URL as progressive enhancement — the button
stays hidden unless both the target element and the Clipboard API resolve,
so no dead control appears without JavaScript and the URL stays selectable.
Retention copy now matches what the code does: deletion is permanent, 0
retains forever, and a blank field means the default on create or the
current value on edit. The permanent-deletion sentence is suppressed for a
retain-forever webhook, which the reaper exempts before computing a cutoff.
Template tests gained a render-completed assertion. Without it, a page that
aborted mid-render still satisfied assertions matching the already-flushed
prefix, because renderTemplate streams to the ResponseWriter (#123 ).
2026-08-11 15:42:08 +02:00
60786c5019
feat: add CSRF protection, SSRF prevention, and login rate limiting ( #42 )
...
check / check (push) Successful in 4s
## Security Hardening
This PR implements three security hardening issues:
### CSRF Protection (closes #35 )
- Session-based CSRF tokens with cryptographically random 256-bit generation
- Constant-time token comparison to prevent timing attacks
- CSRF middleware applied to `/pages`, `/sources`, `/source`, and `/user` routes
- Hidden `csrf_token` field added to all 12+ POST forms in templates
- Excluded from `/webhook` (inbound webhook POSTs) and `/api` (stateless API)
### SSRF Prevention (closes #36 )
- `ValidateTargetURL()` blocks private/reserved IP ranges at target creation time
- Blocked ranges: `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`, plus multicast, reserved, test-net, and CGN ranges
- SSRF-safe HTTP transport with custom `DialContext` in the delivery engine for defense-in-depth (prevents DNS rebinding attacks)
- Only `http` and `https` schemes allowed
### Login Rate Limiting (closes #37 )
- Per-IP rate limiter using `golang.org/x/time/rate`
- 5 attempts per minute per IP on `POST /pages/login`
- GET requests (form rendering) pass through unaffected
- Automatic cleanup of stale per-IP limiter entries every 5 minutes
- `X-Forwarded-For` and `X-Real-IP` header support for reverse proxies
### Files Changed
**New files:**
- `internal/middleware/csrf.go` + tests — CSRF middleware
- `internal/middleware/ratelimit.go` + tests — Login rate limiter
- `internal/delivery/ssrf.go` + tests — SSRF validation + safe transport
**Modified files:**
- `internal/server/routes.go` — Wire CSRF and rate limit middleware
- `internal/handlers/handlers.go` — Inject CSRF token into template data
- `internal/handlers/source_management.go` — SSRF validation on target creation
- `internal/delivery/engine.go` — SSRF-safe HTTP transport for production
- All form templates — Added hidden `csrf_token` fields
- `README.md` — Updated Security section and TODO checklist
`docker build .` passes (lint + tests + build).
Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de >
Co-authored-by: clawbot <clawbot@eeqj.de >
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org >
Reviewed-on: #42
Co-authored-by: clawbot <clawbot@noreply.example.org >
Co-committed-by: clawbot <clawbot@noreply.example.org >
2026-03-17 12:38:45 +01:00
011ec270c2
Replace Bootstrap with Tailwind CSS + Alpine.js ( #14 )
...
check / check (push) Has been cancelled
## Summary
Replaces Bootstrap CSS/JS framework with Tailwind CSS v4 + Alpine.js, matching the µPaaS UI pattern.
## Changes
- **Removed Bootstrap** — all Bootstrap CSS/JS references removed from templates
- **Added Tailwind CSS v4** — `static/css/input.css` with Material Design inspired theme, compiled to `static/css/tailwind.css`
- **Added Alpine.js 3.14.9** — vendored as `static/js/alpine.min.js` for reactive UI components
- **Rewrote all templates** to use Tailwind utility classes:
- `base.html` — new layout structure with footer, matches µPaaS pattern
- `htmlheader.html` — Tailwind CSS link, `[x-cloak]` style
- `navbar.html` — Alpine.js mobile menu toggle, responsive design
- `index.html` — card-based dashboard with Tailwind classes
- `login.html` — centered login form with Material Design styling
- `profile.html` — clean profile layout
- **Added `make css` target** — compiles Tailwind CSS using standalone CLI
- **Component classes** in `input.css` — reusable `.btn-primary`, `.card`, `.input`, `.alert-error` etc.
## Testing
- `make fmt` ✅
- `make check` (fmt-check, lint, test, build) ✅
- `docker build .` ✅
closes #4
Co-authored-by: user <user@Mac.lan guest wan>
Reviewed-on: #14
Co-authored-by: clawbot <clawbot@noreply.example.org >
Co-committed-by: clawbot <clawbot@noreply.example.org >
2026-03-02 00:42:29 +01:00
