shadowdao
eba5a2a38e
Closes the account-takeover chain and related issues found in audit: - WS auth brute-force protection: per-session lockout (authThrottle) + per- socket failure cap that closes the socket (1008); applied to both web-client and desktop auth. Failed auth no longer leaves the socket open for unlimited guesses. - WS upgrades now pass an IP-based rate limiter and Origin allowlist before handleUpgrade (previously bypassed all HTTP middleware); trust proxy set so limiting keys on the real client IP. - /health no longer leaks live session IDs (counts only). - .env.example rate-limit fixed (900000ms / 300) from the accidental ~11k rps. - Credentials moved out of URLs into the X-MacroPad-Password header; images fetched via header + blob URLs; login stores creds in sessionStorage. - Session creation bounded (max sessions, min password length) and TTL-pruned; session store writes are now atomic (temp+rename) and debounced. - Session IDs lengthened to 12 chars with rejection sampling (no modulo bias). - Enable helmet CSP; restrict CORS to configured origins. - Request IDs use crypto.randomUUID; drop postinstall build hook and uuid dep. - Uniform response for unknown session IDs (removes enumeration oracle). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
1.2 KiB
Bash
53 lines
1.2 KiB
Bash
# MacroPad Relay Server Configuration
|
|
# Copy this file to .env and adjust values as needed
|
|
|
|
# Server
|
|
PORT=3000
|
|
HOST=0.0.0.0
|
|
NODE_ENV=production
|
|
|
|
# Security
|
|
BCRYPT_ROUNDS=10
|
|
|
|
# Session ID length (default: 12 characters)
|
|
SESSION_ID_LENGTH=12
|
|
|
|
# Minimum password length enforced on session creation
|
|
MIN_PASSWORD_LENGTH=6
|
|
|
|
# Maximum number of concurrent sessions
|
|
MAX_SESSIONS=1000
|
|
|
|
# Prune sessions unused for this many days
|
|
SESSION_TTL_DAYS=90
|
|
|
|
# HTTP rate limiting (15 minute window, 300 requests per window)
|
|
RATE_LIMIT_WINDOW_MS=900000
|
|
RATE_LIMIT_MAX=300
|
|
|
|
# WebSocket upgrade rate limiting (per IP)
|
|
WS_UPGRADE_WINDOW_MS=60000
|
|
WS_UPGRADE_MAX=60
|
|
|
|
# Auth brute-force protection
|
|
AUTH_MAX_SOCKET_FAILURES=5
|
|
AUTH_LOCKOUT_MAX_ATTEMPTS=10
|
|
AUTH_LOCKOUT_WINDOW_MS=900000
|
|
AUTH_LOCKOUT_DURATION_MS=900000
|
|
|
|
# Allowed origins for CORS + WebSocket (comma-separated). Empty = same-host only.
|
|
# ALLOWED_ORIGINS=https://macropad.example.com
|
|
|
|
# Trust reverse proxy (number of hops, or true/false). Default: 1
|
|
TRUST_PROXY=1
|
|
|
|
# WebSocket timeouts (in milliseconds)
|
|
PING_INTERVAL=30000
|
|
REQUEST_TIMEOUT=30000
|
|
|
|
# Logging (error, warn, info, debug)
|
|
LOG_LEVEL=info
|
|
|
|
# Data directory (default: ./data)
|
|
# DATA_DIR=/path/to/data
|