Harden UI: login brute-force throttle, security headers, Secure cookie flag

- New in-memory login throttle (handler/login_throttle.go): 5 failed attempts per IP or per username within 5 minutes locks that key out for 5 minutes, applied to both /login and the TOTP verification step, which previously had no rate limiting at all - router.New now adds middleware.Secure with X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and HSTS (only when cookies are Secure, implying an HTTPS deployment). No CSP: the existing templates rely on inline <script> blocks, so a CSP strict enough to matter would need 'unsafe-inline' anyway - All session/auth cookies now set Secure based on the new --cookie-secure flag / WGUI_COOKIE_SECURE env var (default true) so the session cookie is never sent over plain HTTP unless explicitly opted into an HTTP-only LAN deployment Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ATVUwTa4Pqwq26orW5BcDW
2026-07-29 15:03:21 +02:00
parent 1539c589a1
commit 4d171b4ff7
7 changed files with 251 additions and 0 deletions
@@ -3813,3 +3813,94 @@ Keine Commits in dieser Session.
 - wireguard/service.go |  23 ++++++++++++-----

 ---
+## 2026-07-29 14:29 – 14:31 (2m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+- 1539c58 Normalize AllocatedIPs/ExtraAllowedIPs to network address before ip route replace
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---
+## 2026-07-29 14:34 – 14:34 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---
+## 2026-07-29 14:35 – 14:36 (1m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---
+## 2026-07-29 14:39 – 14:39 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---
+## 2026-07-29 14:40 – 14:40 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---
+## 2026-07-29 14:40 – 14:41 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---
+## 2026-07-29 14:41 – 14:41 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** wireguard-ui-multi
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md         | 216 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+- templates/wg.conf |   2 +-
+- util/util.go      |  21 +++++++++-
+
+---