Adam French b56f8253d9 Harden backend against critical and high security vulnerabilities ...

- Fix WebSocket CheckOrigin to use proper url.Parse instead of string stripping
- Add admin auth checks to Users/User GraphQL queries
- Remove GraphQL GET transport to prevent CSRF via cross-site links
- Add application-level IP-based login rate limiting (5 attempts/min)
- Add path traversal bounds check on radio file upload
- Require DEV_MODE for GraphQL introspection and playground
- Move notes backend endpoint behind admin middleware
- Add dedicated Nginx rate limit zone for GraphQL (10r/s)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-14 13:27:33 +01:00

..

handle_auth.go

Harden backend against critical and high security vulnerabilities

2026-04-14 13:27:33 +01:00

handle_message_upload.go

Don't use SaveUploadedFile (causing permission issues)

2026-03-09 17:21:26 +00:00

handle_notes.go

adjust frontend for any filetype and add metadata to api response

2026-01-13 12:23:36 +00:00

handle_radio.go

Harden backend against critical and high security vulnerabilities

2026-04-14 13:27:33 +01:00

handle_rowing.go

Fix security vulnerabilities across backend, frontend, and infra

2026-03-29 23:59:10 +01:00

handle_spotify.go

Fix security vulnerabilities across backend, frontend, and infra

2026-03-29 23:59:10 +01:00

handle_websocket.go

Fix WebSocket 403 in dev mode by allowing localhost origins

2026-03-25 16:59:13 +00:00

store.go

Harden backend against critical and high security vulnerabilities

2026-04-14 13:27:33 +01:00