shadowdao
eba5a2a38e
Closes the account-takeover chain and related issues found in audit: - WS auth brute-force protection: per-session lockout (authThrottle) + per- socket failure cap that closes the socket (1008); applied to both web-client and desktop auth. Failed auth no longer leaves the socket open for unlimited guesses. - WS upgrades now pass an IP-based rate limiter and Origin allowlist before handleUpgrade (previously bypassed all HTTP middleware); trust proxy set so limiting keys on the real client IP. - /health no longer leaks live session IDs (counts only). - .env.example rate-limit fixed (900000ms / 300) from the accidental ~11k rps. - Credentials moved out of URLs into the X-MacroPad-Password header; images fetched via header + blob URLs; login stores creds in sessionStorage. - Session creation bounded (max sessions, min password length) and TTL-pruned; session store writes are now atomic (temp+rename) and debounced. - Session IDs lengthened to 12 chars with rejection sampling (no modulo bias). - Enable helmet CSP; restrict CORS to configured origins. - Request IDs use crypto.randomUUID; drop postinstall build hook and uuid dep. - Uniform response for unknown session IDs (removes enumeration oracle). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
35 lines
852 B
JSON
35 lines
852 B
JSON
{
|
|
"name": "macropad-relay",
|
|
"version": "1.0.0",
|
|
"description": "Relay server for MacroPad remote access",
|
|
"main": "dist/index.js",
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"start": "node dist/index.js",
|
|
"dev": "nodemon --exec ts-node src/index.ts",
|
|
"clean": "rm -rf dist"
|
|
},
|
|
"keywords": ["macropad", "relay", "websocket", "proxy"],
|
|
"author": "ShadowDao",
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"bcrypt": "^5.1.1",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.3.1",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^7.1.5",
|
|
"helmet": "^7.1.0",
|
|
"typescript": "^5.3.2",
|
|
"winston": "^3.11.0",
|
|
"ws": "^8.14.2"
|
|
},
|
|
"devDependencies": {
|
|
"@types/bcrypt": "^5.0.2",
|
|
"@types/cors": "^2.8.16",
|
|
"@types/express": "^4.17.21",
|
|
"@types/ws": "^8.5.9",
|
|
"nodemon": "^3.0.2",
|
|
"ts-node": "^10.9.2"
|
|
}
|
|
}
|