fix(security): harden auth, upload, and API configuration

- Lock public registration to first-user bootstrap (403 afterwards)
- Require JwtAuthGuard on upload + whitelist png/jpg/webp/gif (SVG/XSS blocked)
- Add global throttling (login/register 5/min, upload 10/min)
- Add helmet security headers; serve uploads with nosniff
- Replace permissive CORS (origin:true+credentials) with CORS_ORIGINS whitelist
- Disable Swagger outside development; sanitize 500 error responses
- Enforce 32+ char JWT_SECRET; make token expiry configurable (TOKEN_EXPIRES_IN)
- Re-check user in DB on every JWT validation (revocation on user delete)
- Dummy bcrypt compare to prevent login user-enumeration via timing
- Map malformed BigInt inputs to 400 instead of 500
- Widen .gitignore to .env* and add apps/api/.env.example
- Disable Nuxt devtools and sourcemaps

This commit is contained in:

yeuimu

2026-08-22 11:55:13 +08:00

parent 9ed569f5bc

commit 9c1106586a

14 changed files with 240 additions and 112 deletions

									
										apps/website/nuxt.config.ts
									
		+2
		-1
	
												View File
												
				@@ -1,6 +1,7 @@

				export default defineNuxtConfig({

				  compatibilityDate: '2025-07-15',

				  devtools: { enabled: true },

				  devtools: { enabled: false },

				  sourcemap: { server: false, client: false },

				  modules: ['@nuxtjs/seo'],