UniqueSoft/TenerifeProp
2
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

[MEDIUM] Security: CORS, HTTPS, secrets in code #16

New Issue
Open
opened 2026-04-19 11:21:33 +00:00 by NW · 0 comments
NW commented 2026-04-19 11:21:33 +00:00
Owner
Copy Link

Problem

Multiple security issues for production.

Issues:

  1. CORS set to * (allows all origins) — must restrict to domain
  2. No HTTPS in Docker config
  3. Admin password hardcoded in seed: Admin@2026!
  4. No CSRF token verification on POST requests
  5. No helmet/security headers
  6. No rate limiting on static files

Required:

  • Restrict CORS to specific origins
  • Add HTTPS support (reverse proxy or direct)
  • Move seed password to env variable
  • Verify CSRF token on state-changing requests
  • Add security headers

Files: src/server/index.ts, docker-compose.yml, Dockerfile

Migrated from UniqueSoft/APAW#81

## Problem Multiple security issues for production. ### Issues: 1. CORS set to * (allows all origins) — must restrict to domain 2. No HTTPS in Docker config 3. Admin password hardcoded in seed: Admin@2026! 4. No CSRF token verification on POST requests 5. No helmet/security headers 6. No rate limiting on static files ### Required: - [ ] Restrict CORS to specific origins - [ ] Add HTTPS support (reverse proxy or direct) - [ ] Move seed password to env variable - [ ] Verify CSRF token on state-changing requests - [ ] Add security headers ### Files: src/server/index.ts, docker-compose.yml, Dockerfile --- *Migrated from UniqueSoft/APAW#81*
NW added this to the Production Readiness - Phase 2 milestone 2026-04-19 11:21:33 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
component::admin
Компонент: админ-панель
 priority::high
Приоритет: высокий
 status::new
Статус: новая
 type::bug
Тип: баг
No Label
Milestone
No items
No Milestone Production Readiness - Phase 2
Projects
Clear projects
No project
Assignees
Clear assignees
NW olilovedani
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: UniqueSoft/TenerifeProp#16
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?