cat/Kanban
Private
Public Access
1
0
Fork 0
Code Activity

Add CSP/HSTS headers, attachment extension whitelist, and upload rate limiting

Browse Source 
- Add Content-Security-Policy and Strict-Transport-Security headers
- Whitelist allowed file extensions on attachment uploads
- Add rate limiting to password change (5/5min) and file uploads (20/60s)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Catherine Renelle
2026-03-07 19:25:02 -05:00
parent d418c367cb
commit 0852d5a804
6 changed files with 40 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/hooks.server.ts
+2
View File
@@ -71,6 +71,8 @@ export const handle: Handle = async ({ event, resolve }) => {
response.headers.set('X-Frame-Options', 'DENY');
response.headers.set('X-Content-Type-Options', 'nosniff');
response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' ws: wss:; frame-ancestors 'none'");
logger.info({
method: event.request.method,