7f4c40caca
All checks were successful
check / check (push) Successful in 4s
Security hardening implementing three issues: CSRF Protection (#35): - Session-based CSRF tokens with cryptographically random generation - Constant-time token comparison to prevent timing attacks - CSRF middleware applied to /pages, /sources, /source, and /user routes - Hidden csrf_token field added to all 12+ POST forms in templates - Excluded from /webhook (inbound) and /api (stateless) routes SSRF Prevention (#36): - ValidateTargetURL blocks private/reserved IP ranges at target creation - Blocked ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7, fe80::/10, plus multicast, reserved, test-net, and CGN ranges - SSRF-safe HTTP transport with custom DialContext for defense-in-depth at delivery time (prevents DNS rebinding attacks) - Only http/https schemes allowed Login Rate Limiting (#37): - Per-IP rate limiter using golang.org/x/time/rate - 5 attempts per minute per IP on POST /pages/login - GET requests (form rendering) pass through unaffected - Automatic cleanup of stale per-IP limiter entries - X-Forwarded-For and X-Real-IP header support for reverse proxies Closes #35, closes #36, closes #37
54 lines
2.6 KiB
HTML
54 lines
2.6 KiB
HTML
{{define "navbar"}}
|
|
<nav class="app-bar" x-data="{ open: false }">
|
|
<div class="max-w-6xl mx-auto flex justify-between items-center">
|
|
<div class="flex items-center gap-3">
|
|
<a href="/" class="text-xl font-medium text-gray-900 hover:text-primary-600 transition-colors">Webhooker</a>
|
|
</div>
|
|
|
|
<!-- Mobile menu button -->
|
|
<button @click="open = !open" class="md:hidden p-2 rounded-md text-gray-500 hover:bg-gray-100">
|
|
<svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
|
<path x-show="!open" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
|
|
<path x-show="open" x-cloak stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
|
|
</svg>
|
|
</button>
|
|
|
|
<!-- Desktop navigation -->
|
|
<div class="hidden md:flex items-center gap-4">
|
|
{{if .User}}
|
|
<a href="/sources" class="btn-text">Sources</a>
|
|
<a href="/user/{{.User.Username}}" class="btn-text">
|
|
<svg class="w-5 h-5 mr-1" fill="currentColor" viewBox="0 0 16 16">
|
|
<path d="M11 6a3 3 0 1 1-6 0 3 3 0 0 1 6 0z"/>
|
|
<path fill-rule="evenodd" d="M0 8a8 8 0 1 1 16 0A8 8 0 0 1 0 8zm8-7a7 7 0 0 0-5.468 11.37C3.242 11.226 4.805 10 8 10s4.757 1.225 5.468 2.37A7 7 0 0 0 8 1z"/>
|
|
</svg>
|
|
{{.User.Username}}
|
|
</a>
|
|
<form method="POST" action="/pages/logout" class="inline">
|
|
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
|
|
<button type="submit" class="btn-text">Logout</button>
|
|
</form>
|
|
{{else}}
|
|
<a href="/pages/login" class="btn-primary">Login</a>
|
|
{{end}}
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Mobile navigation -->
|
|
<div x-show="open" x-cloak x-transition class="md:hidden mt-4 pt-4 border-t border-gray-200">
|
|
<div class="flex flex-col gap-2">
|
|
{{if .User}}
|
|
<a href="/sources" class="btn-text w-full text-left">Sources</a>
|
|
<a href="/user/{{.User.Username}}" class="btn-text w-full text-left">Profile</a>
|
|
<form method="POST" action="/pages/logout">
|
|
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
|
|
<button type="submit" class="btn-text w-full text-left">Logout</button>
|
|
</form>
|
|
{{else}}
|
|
<a href="/pages/login" class="btn-primary w-full">Login</a>
|
|
{{end}}
|
|
</div>
|
|
</div>
|
|
</nav>
|
|
{{end}}
|