Update Apache SSL configuration and enhance security features across multiple files. Changed X-Frame-Options to SAMEORIGIN for better security, added optional Content Security Policy headers for testing, and improved password handling with HaveIBeenPwned checks during user registration and password reset. Implemented passkey login functionality in the authentication flow, including UI updates for user experience. Enhanced image upload processing with size limits and validation, and added rate limiting for various API endpoints to prevent abuse.

2026-01-05 11:50:57 +01:00
parent 8bd7ed76cd
commit 673c34ac9d
47 changed files with 1738 additions and 83 deletions
--- a/AUTH_README.md
+++ b/AUTH_README.md
@@ -43,7 +43,7 @@ Oder mit einem Online-Tool: https://bcrypt-generator.com/ (Rounds: 10)

 ## Dateien

- `server/data/users.json` - Benutzerdaten (verschlüsselte Passwörter)
+- `server/data/users.json` - Benutzerdaten (Datei verschlüsselt; Passwörter sind bcrypt-Hashes)
 - `server/data/members.json` - Mitgliederdaten (Telefon, E-Mail, etc.)
 - `server/data/sessions.json` - Aktive Sessions

@@ -52,6 +52,7 @@ Oder mit einem Online-Tool: https://bcrypt-generator.com/ (Rounds: 10)
 - Passwörter werden mit bcrypt gehasht (Rounds: 10)
 - JWT-Tokens für Sessions (7 Tage gültig)
 - HTTP-Only Cookies
+- Optional: Passwort-Prüfung gegen HaveIBeenPwned (k-Anonymity) via `HIBP_ENABLED=true`
 - Geschützte API-Routen
 - Middleware für geschützte Seiten