BitSquare/Codeman
2
0
Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-10-06 23:49:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: extract QR auth magic numbers into named constants, add 16 security tests

Browse Source 
Replace hardcoded per-IP rate limit (10) and cookie maxAge (86400) in
system-routes.ts with QR_AUTH_FAILURE_MAX and AUTH_SESSION_TTL_MS/1000
so both auth paths stay in sync if constants change.

Add 16 new tests: grace period boundary precision, base62 charset
validation, current+previous token during grace, stopTokenRotation
state cleanup, rate limit reset, consumed token eviction, full
end-to-end QR flow, per-IP 429, cookie attributes, concurrent race,
regenerate invalidation, URL encoding, path traversal, /q without
param, and session record method:qr.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
arkon
2026-03-01 17:32:02 +01:00
co-authored by Claude Opus 4.6
parent d094d9ec50
commit 18217268bf
3 changed files with 239 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/config/tunnel-config.ts
+3
View File
@@ -30,6 +30,9 @@ export const QR_RATE_LIMIT_MAX = 30;
/** QR rate limit reset window (ms) */
export const QR_RATE_LIMIT_WINDOW_MS = 60_000;
/** Per-IP rate limit for QR auth failures (separate from Basic Auth AUTH_FAILURE_MAX) */
export const QR_AUTH_FAILURE_MAX = 10;
// ============================================================================
// Tunnel Process Lifecycle
// ============================================================================