ric-rac/sourcexchange.net
Watch
2
1
Fork
You've already forked sourcexchange.net
 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Harden authentication, API authorisation and response headers #4

Merged
ArnaudLier merged 2 commits from otte/security-hardening into main 2026-10-15 08:55:30 +00:00 AGit
Conversation 1 Commits 2 Files changed 22 +131 -38
Otte commented 2026-09-23 10:27:47 +00:00
Contributor

multiple sec issues fixed.

  • forgot-password had no rate limit at all
  • password reset didn't kill API tokens or sessions
  • /api/team-products and /api/products/blueprint answered tokens with no
    abilities; team-products also returns drafts
  • published scope only checked status, isPublished() also checks published_at
  • no X-Frame-Options / nosniff / Referrer-Policy / Permissions-Policy
  • locale from /locale/{x} was stored unchecked
  • transfer API key compared with !=
  • every Discord link made a new row
  • connection edit form printed the raw data blob incl. OAuth tokens
  • release disk resolved three different ways
multiple sec issues fixed. - forgot-password had no rate limit at all - password reset didn't kill API tokens or sessions - /api/team-products and /api/products/blueprint answered tokens with no abilities; team-products also returns drafts - published scope only checked status, isPublished() also checks published_at - no X-Frame-Options / nosniff / Referrer-Policy / Permissions-Policy - locale from /locale/{x} was stored unchecked - transfer API key compared with != - every Discord link made a new row - connection edit form printed the raw data blob incl. OAuth tokens - release disk resolved three different ways
Otte force-pushed otte/security-hardening from f517e5d52a
Some checks failed
Tests / tests (pull_request) Has been cancelled
Details
to 972efe409d
All checks were successful
Tests / tests (pull_request) Successful in 1m0s
Details
2026-09-23 10:31:27 +00:00 Compare
ArnaudLier reviewed 2026-10-07 21:04:48 +00:00
app/Http/Middleware/SecurityHeaders.php
@ -0,0 +17,4 @@
{
$response = $next($request);
$response->headers->set('X-Content-Type-Options', 'nosniff');
ArnaudLier commented 2026-10-07 21:04:48 +00:00
Owner

I prefer these being in NGINX's configuration only I think and they would be duplicated with the current configuration.

I prefer these being in NGINX's configuration only I think and they would be duplicated with the current configuration.
Leave security response headers to NGINX
Some checks failed
Tests / tests (pull_request) Has been cancelled
Details
8c3a4fee06 
The headers are already set in the NGINX configuration, so setting them in the application as well would duplicate them.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ric-rac/sourcexchange.net!4
No description provided.