sneak/webhooker
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

security: add headers middleware, session regeneration, and body size limits #41

Merged
sneak merged 1 commits from security/headers-session-bodylimit into main 2026-03-05 12:32:56 +01:00
Conversation 2 Commits 1 Files Changed 5 +127 -9

1 Commits

Author SHA1 Message Date
clawbot
6c6d6c2f6f security: add headers middleware, session regeneration, and body size limits
All checks were successful
check / check (push) Successful in 6s
Details 
- Add SecurityHeaders middleware applied globally: HSTS, X-Content-Type-Options,
  X-Frame-Options, CSP, Referrer-Policy, and Permissions-Policy headers on every
  response.
- Add session regeneration (Regenerate method) after successful login to prevent
  session fixation attacks. Old session is destroyed and a new ID is issued.
- Add MaxBodySize middleware using http.MaxBytesReader to limit POST/PUT/PATCH
  request bodies to 1 MB on all form endpoints (/pages, /sources, /source/*).
- Update README.md: document SecurityHeaders and MaxBodySize in the middleware
  stack, update Security section, move security headers to completed TODO.

Closes #34, closes #38, closes #39
 2026-03-05 02:55:09 -08:00