jukka/intra.cuitunet.fi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add security hardening, captcha login, and password reset via email

Browse Source 
- .htaccess: HTTPS enforcement, security headers, block sensitive files
- data/.htaccess: deny all direct access to data directory
- Secure session settings (httponly, secure, strict mode, samesite)
- Rate limiting on login (10 attempts per 15 min per IP)
- Math captcha on login form (server-side validated)
- Password reset via email with token (1 hour expiry)
- Forgot password UI with reset link flow
- Email field added to user management
- Updated .gitignore for reset_tokens.json and login_attempts.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jukka Lampikoski
2026-03-10 01:00:19 +02:00
parent e4914e9edb
commit 8a07689a1f
7 changed files with 388 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
data/.htaccess Normal file
View File

@@ -0,0 +1,2 @@
# Estä kaikki suora pääsy data-kansioon
Deny from all