TRX/Checkmate
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,228 Commits 70 Branches 35 Tags
b118a321b9d166310930536f741f82c30efaaa9f
Commit Graph
11 Commits
Author SHA1 Message Date
Alex Holliday b3b6f1d834 move all v1 files to v1 dirs 2025-09-23 14:23:45 -07:00
Alex Holliday 003d419a64 Revert "Merge pull request #2974 from bluewave-labs/fix/cleanup" 
This reverts commit 7368cb2567, reversing
changes made to 72882fded9.
 2025-09-23 14:05:16 -07:00
Alex Holliday f945a27011 move v1 to v1 dir, add build workflow 2025-09-23 11:59:02 -07:00
Alexander Holliday 38b2025286 Merge branch 'develop' into security/add-jwt-cookie-infrastructure 2025-08-11 15:08:54 -07:00
Alex Holliday 0bc8142e71 move to middleware 2025-08-11 15:02:07 -07:00
gorkem-bwl 05945a9a74 feat: add JWT cookie infrastructure 
Adds the foundation for secure cookie-based authentication without changing
the authentication flow. This prepares the codebase for moving JWT tokens
from Redux state to httpOnly cookies in a follow-up PR.

Changes:
- Added cookie-parser dependency for HTTP cookie handling
- Added cookieParser() middleware to Express application
- Created cookieHelpers.js utilities for consistent cookie options
- Includes getAuthCookieOptions() for setting secure authentication cookies
- Includes getClearAuthCookieOptions() for clearing cookies on logout

Infrastructure only - no behavioral changes to authentication flow yet.

Files added/modified:
- package.json (cookie-parser dependency)
- src/app.js (cookieParser middleware)
- src/utils/cookieHelpers.js (cookie utilities)

Next steps:
- Follow-up PR will modify JWT verification to check cookies
- Enable secure cookie-based authentication
- Add logout functionality to clear httpOnly cookies

Risk level: LOW (infrastructure only, no authentication changes)
 2025-08-11 17:47:09 -04:00
gorkem-bwl 88b68a9df0 fix: apply prettier formatting to app.js 
Fixed formatting issues to pass CI/CD checks
 2025-08-11 17:39:08 -04:00
gorkem-bwl 8b322a0ec0 feat: apply input sanitization to prevent XSS attacks 
Enables comprehensive XSS protection by applying sanitization middleware
to all incoming requests. Uses the sanitization utilities added in previous PR.

Changes:
- Added sanitizeBody() and sanitizeQuery() middleware after express.json()
- Enhanced Content Security Policy headers for additional XSS protection
- Added 'object-src: none' and 'base-uri: self' directives
- All user inputs now automatically sanitized before processing

Security improvements:
- Prevents stored XSS attacks through HTML sanitization
- Recursive sanitization handles nested objects and arrays
- Maintains backward compatibility with existing functionality
- Strengthened CSP headers block unsafe content injection

Files changed: src/app.js (9 lines added)
Risk level: Medium (global middleware application)
 2025-08-11 17:33:05 -04:00
Alex Holliday f3e50120ee appSettings -> envSettings 2025-07-28 14:37:18 -07:00
Alex Holliday ec99b5e9b4 add rate limiting 2025-07-28 12:00:09 -07:00
Alex Holliday 1c47c8ce2c move to src 2025-07-25 15:33:48 -07:00