ric-rac/sourcexchange.net
Watch
2
1
Fork
You've already forked sourcexchange.net
 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Leave security response headers to NGINX #6

Closed
Otte wants to merge 2 commits from otte/pr4 into main AGit
pull from: otte/pr4
merge into: ric-rac:main
Conversation 0 Commits 2 Files changed 22 +131 -38
Otte commented 2026-10-14 08:09:09 +00:00
Contributor

The headers are already set in the NGINX configuration, so setting them in the application as well would duplicate them.

The headers are already set in the NGINX configuration, so setting them in the application as well would duplicate them.
Harden authentication, API authorisation and response headers
All checks were successful
Tests / tests (pull_request) Successful in 1m0s
Details
972efe409d 
Addresses a set of low and medium severity issues found while reviewing
the application against a local instance.

Authentication and sessions:
- Throttle Fortify routes; /forgot-password previously accepted unlimited
  requests, allowing reset-token rotation and mail flooding.
- Revoke API tokens and database sessions when a password is reset, so a
  recovered account no longer leaves existing credentials valid.
- Make the Sanctum token lifetime configurable rather than fixed to never.

Authorisation:
- Require the read ability on /api/team-products and /api/products/blueprint.
  Both previously answered tokens created with no abilities at all, and
  team-products exposes unpublished drafts.
- Gate role assignment in the user resource behind the role update permission.
- Add impersonation guards so impersonating requires an explicit permission
  and administrators cannot be impersonated.

Input validation:
- Validate the locale against the available translations before storing it
  in the session.
- Compare the transfer API key with hash_equals and validate the payload
  instead of iterating unchecked request input.
- Look the transfer user up once instead of once per transaction.

Product visibility:
- Align the published scope with isPublished(). The scope matched on status
  alone, so products awaiting a publish date were listed publicly even though
  their detail page correctly returned 403.
- Set the status alongside published_at in the publish bulk action.

Transport and headers:
- Add X-Content-Type-Options, X-Frame-Options, Referrer-Policy,
  Permissions-Policy and, over HTTPS, Strict-Transport-Security.
- Make trusted proxies configurable, since the forwarded headers are enabled
  while no proxy is trusted.

Data handling:
- Store one connection per user and type, replacing the row created on every
  Discord link, and add the matching unique index.
- Stop rendering the raw connection payload in the admin form; it contains
  OAuth access and refresh tokens.
- Escape markup when encoding the product JSON-LD block.
- Resolve the product release disk in one place so uploads, downloads,
  deletions and size lookups agree.
Leave security response headers to NGINX
Some checks failed
Tests / tests (pull_request) Has been cancelled
Details
8c3a4fee06 
The headers are already set in the NGINX configuration, so setting them in the application as well would duplicate them.
Otte closed this pull request 2026-10-14 08:18:18 +00:00
Some checks failed
Tests / tests (pull_request) Has been cancelled
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ric-rac/sourcexchange.net!6
No description provided.