44df50362a
- Add CSRF protection with cookie-based tokens - Add cookie-parser and csurf middleware - Create GET /api/csrf-token endpoint - Frontend automatically includes CSRF token in POST/PUT/DELETE requests - Add retry logic for expired CSRF tokens - Implement account lockout mechanism - Add database fields: failedLoginAttempts, lockedUntil - Track failed login attempts and lock accounts after max attempts (configurable) - Auto-unlock after lockout duration expires - Return helpful error messages with remaining time - Add comprehensive security environment variables - Rate limiting configuration (API, auth, email endpoints) - CSRF protection toggle - Password policy requirements - Account lockout settings - Logging levels - Add comprehensive test coverage - 6 new tests for account lockout functionality - 11 new tests for CSRF protection - All tests handle enabled/disabled states gracefully - Update documentation - Add Phase 3 security hardening to SESSION_CONTEXT.md - Document new database fields and migration - Update progress to 85% Files changed: - Backend: app.js, auth controller, security config, new migration - Frontend: api.js with CSRF token handling - Tests: auth.test.js (extended), csrf.test.js (new) - Config: .env examples with security variables - Docs: SESSION_CONTEXT.md updated
53 lines
1.1 KiB
Plaintext
53 lines
1.1 KiB
Plaintext
# Server
|
|
NODE_ENV=production
|
|
PORT=3000
|
|
|
|
# CORS
|
|
CORS_ORIGIN=http://localhost
|
|
|
|
# Database (production)
|
|
DATABASE_URL=postgresql://spotlightcam:spotlightcam123@db-prod:5432/spotlightcam?schema=public
|
|
|
|
# JWT (CHANGE THESE IN PRODUCTION!)
|
|
JWT_SECRET=production-secret-key-CHANGE-THIS-IN-REAL-PRODUCTION
|
|
JWT_EXPIRES_IN=24h
|
|
|
|
# AWS SES (REPLACE WITH YOUR CREDENTIALS)
|
|
AWS_REGION=eu-central-1
|
|
AWS_ACCESS_KEY_ID=your-aws-access-key-id
|
|
AWS_SECRET_ACCESS_KEY=your-aws-secret-access-key
|
|
SES_FROM_EMAIL=noreply@spotlight.cam
|
|
SES_FROM_NAME=spotlight.cam
|
|
|
|
# Email Settings
|
|
FRONTEND_URL=http://localhost
|
|
VERIFICATION_TOKEN_EXPIRY=24h
|
|
|
|
# Security - Rate Limiting
|
|
RATE_LIMIT_ENABLED=true
|
|
RATE_LIMIT_WINDOW_MS=900000
|
|
RATE_LIMIT_MAX=100
|
|
RATE_LIMIT_AUTH_MAX=5
|
|
RATE_LIMIT_EMAIL_MAX=3
|
|
|
|
# Security - CSRF Protection
|
|
ENABLE_CSRF=true
|
|
|
|
# Security - Body Size Limits
|
|
BODY_SIZE_LIMIT=10kb
|
|
|
|
# Security - Password Policy
|
|
PASSWORD_MIN_LENGTH=8
|
|
PASSWORD_REQUIRE_UPPERCASE=true
|
|
PASSWORD_REQUIRE_LOWERCASE=true
|
|
PASSWORD_REQUIRE_NUMBER=true
|
|
PASSWORD_REQUIRE_SPECIAL=false
|
|
|
|
# Security - Account Lockout
|
|
ENABLE_ACCOUNT_LOCKOUT=true
|
|
MAX_LOGIN_ATTEMPTS=5
|
|
LOCKOUT_DURATION_MINUTES=15
|
|
|
|
# Logging
|
|
LOG_LEVEL=warn
|