Matthew Knight
199642242f
- Regenerate session ID on login to prevent session fixation (H1) - Add mutex to login lockout counters to fix race condition (H2) - Validate issuer/audience claims on Apple ID tokens (M2) - Verify comment belongs to ticket's issue to prevent attachment IDOR (M4) - Stop SSO from re-approving admin-disapproved users (M3) - Add Content-Security-Policy header (M1) - Configure trusted proxies via TRUSTED_PROXIES env var (M6) - Cap password length at 128 for bcrypt truncation (L1) - Set Secure flag on flash cookies over HTTPS (L2) - Rate-limit POST /reset-password (L3) - Add authenticated password change at /account/password (L4) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| auth | ||
| config | ||
| database | ||
| forgejo | ||
| handlers | ||
| markdown | ||
| middleware | ||
| models | ||
| templates | ||