Security pass

2026-02-20 12:59:10 +00:00
parent a5a2ffd83e
commit b4d91d5dc0
3 changed files with 14 additions and 3 deletions
@@ -21,6 +21,10 @@
 - [x] Login rate limiting (1 attempt per 5 seconds)
 - [x] Global rate limiting middleware (per-endpoint: 120/min public, 10/min register, 60/min filters, none admin)
 - [x] Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection)
+- [ ] **Strict-Transport-Security (HSTS)** - Tell browsers to only access via HTTPS, prevents downgrade attacks. Add after HTTPS is working in prod.
+- [ ] **Referrer-Policy** - Track referrer sources for analytics (social media tracking). Use `strict-origin-when-cross-origin` to send origin but not full URLs.
+- [ ] **Rate limiter + Cloudflare** - Currently doesn't read CF-Connecting-IP header, so behind Cloudflare all users share one rate limit bucket.
+- [ ] **Account creation spam** - Registration endpoint (10/min) could benefit from additional bot protection beyond rate limiting.
 - [x] Input validation on all endpoints:
  - Registration: name (1-50), email (255), phone (20), password (72), age 16+
  - Services: name (100), price (>0), duration (1-480), patch test (0-168), age (0-100)