 popertots
|
a5a2ffd83e
|
Security: add rate limiting, input validation, and filter category
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
|
2026-02-20 12:03:14 +00:00 |
|