scripte/timemaster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: N-1 uvicorn proxy-headers + N-2 Token-Reuse-Detection + N-3 XSS-Audit + N-4 Token-URL-Fragment + N-5 pip-audit CI
Security Audit / Python Dependency Audit (push) Has been cancelled
Details
Security Audit / Node.js Dependency Audit (push) Has been cancelled
Details

Browse Source 
N-1: uvicorn --proxy-headers --forwarded-allow-ips=127.0.0.1
- timemaster.service: proxy-headers Flag gesetzt (beide Server)

N-2: Refresh-Token Re-Use-Detection
- auth_service.py: verbrauchter Token-Hash 48h in Redis (burned_token:<hash>)
- Bei erneutem Einsatz: alle Sessions invalidieren + AuditLog + HTTP 401

N-3: dangerouslySetInnerHTML-Audit
- Kein Vorkommen im Frontend gefunden — sauber

N-4: Reset/Invite-Token als URL-Fragment statt Query-Parameter
- email_service.py: ?token= → # (Fragment wird nicht in Referer gesendet)
- ResetPasswordPage.tsx: useSearchParams → window.location.hash.slice(1)
- Token-Lebensdauern geprüft: Reset 1h, Invite 7d — OK

N-5: Gitea CI Security-Workflow
- .gitea/workflows/security.yml: pip-audit + npm audit
- Trigger: push/PR auf main + wöchentlich montags

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
patrick
2026-05-26 12:55:41 +02:00
parent 4dc69137dd
commit f2e997475e
6 changed files with 160 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEVLOG.md
+34
View File
@@ -1749,3 +1749,37 @@ Keine Commits in dieser Session.
- frontend/src/context/AuthContext.tsx | 14 +++--
---
## 2026-05-26 11:30 – 11:35 (5m)
**Beschreibung:** Claude Code Session
**Projekt:** timemaster
### Commits
- 4dc6913 security: H-1 settings-Whitelist + H-5 UUID-Guard + H-6 DNS-Pinning + H-7 Heartbeat-Timing
### Geänderte Dateien
- DEVLOG.md | 42 ++++++++++++++++++
- backend/app/core/dependencies.py | 12 ++++--
- backend/app/core/kiosk_security.py | 11 +++--
- backend/app/routers/companies.py | 8 +++-
- backend/app/schemas/company.py | 17 +++++++-
- backend/app/services/caldav_service.py | 78 +++++++++++++++++++++++++++++-----
- backend/app/services/kiosk_service.py | 8 +++-
---
## 2026-05-26 11:36 – 11:36 (0m)
**Beschreibung:** Claude Code Session
**Projekt:** timemaster
### Commits
Keine Commits in dieser Session.
### Geänderte Dateien
- DEVLOG.md | 42 ++++++++++++++++++
- backend/app/core/dependencies.py | 12 ++++--
- backend/app/core/kiosk_security.py | 11 +++--
- backend/app/routers/companies.py | 8 +++-
- backend/app/schemas/company.py | 17 +++++++-
- backend/app/services/caldav_service.py | 78 +++++++++++++++++++++++++++++-----
- backend/app/services/kiosk_service.py | 8 +++-
---