yeuimu
9c1106586a
- Lock public registration to first-user bootstrap (403 afterwards) - Require JwtAuthGuard on upload + whitelist png/jpg/webp/gif (SVG/XSS blocked) - Add global throttling (login/register 5/min, upload 10/min) - Add helmet security headers; serve uploads with nosniff - Replace permissive CORS (origin:true+credentials) with CORS_ORIGINS whitelist - Disable Swagger outside development; sanitize 500 error responses - Enforce 32+ char JWT_SECRET; make token expiry configurable (TOKEN_EXPIRES_IN) - Re-check user in DB on every JWT validation (revocation on user delete) - Dummy bcrypt compare to prevent login user-enumeration via timing - Map malformed BigInt inputs to 400 instead of 500 - Widen .gitignore to .env* and add apps/api/.env.example - Disable Nuxt devtools and sourcemaps
18 lines
589 B
Bash
18 lines
589 B
Bash
# Prisma connection string (PostgreSQL)
|
|
DATABASE_URL=postgresql://postgres:CHANGE_ME@localhost:5432/inkreach-official-website
|
|
|
|
# JWT signing secret: generate with `node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"`
|
|
# Must be at least 32 characters.
|
|
JWT_SECRET=CHANGE_ME_TO_A_STRONG_RANDOM_SECRET
|
|
|
|
# Access token lifetime (jwt-rest compatible, e.g. 30m, 12h, 7d)
|
|
TOKEN_EXPIRES_IN=7d
|
|
|
|
# Comma-separated list of allowed CORS origins (leave empty to disable CORS)
|
|
CORS_ORIGINS=http://localhost:5173
|
|
|
|
# Global rate limit per minute (per IP)
|
|
THROTTLE_LIMIT=120
|
|
|
|
PORT=3001
|