Security hardening before production use

barrettruth commented

2026-03-22 23:51:11 +00:00

Copy link

Problem

Delta is now deployed but needs security hardening before real use at delta.barrettruth.com.

Open Items

Critical:

Rate limiting on /api/auth/login — currently unlimited brute force attempts
CSRF protection on mutation endpoints (POST/PATCH/DELETE)
Input validation/sanitization on all API endpoints (description, notes could contain XSS if rendered unsanitized)

Important:

Session tokens should be cryptographically random (currently uses crypto.randomBytes(32) — good, but verify entropy)
API key rotation should invalidate all active sessions for that user
DATABASE_URL env var contains the SQLite path — ensure the file is only readable by the delta system user
ACME SSL certificate auto-renewal for delta.barrettruth.com
Strict-Transport-Security header via nginx
X-Content-Type-Options: nosniff header
X-Frame-Options: DENY header

Nice to have:

Account lockout after N failed login attempts
Session expiry cleanup (cron to delete expired sessions from DB)
Audit log for auth events (login, logout, API key use)
Content Security Policy header
Consider invite-only registration (#24)

Context

Self-hosted on Netcup VPS behind nginx + ACME. Single user initially but friends may want accounts. The app is internet-accessible.

## Problem Delta is now deployed but needs security hardening before real use at `delta.barrettruth.com`. ## Open Items **Critical:** - [ ] Rate limiting on `/api/auth/login` — currently unlimited brute force attempts - [ ] CSRF protection on mutation endpoints (POST/PATCH/DELETE) - [ ] Input validation/sanitization on all API endpoints (description, notes could contain XSS if rendered unsanitized) **Important:** - [ ] Session tokens should be cryptographically random (currently uses `crypto.randomBytes(32)` — good, but verify entropy) - [ ] API key rotation should invalidate all active sessions for that user - [ ] `DATABASE_URL` env var contains the SQLite path — ensure the file is only readable by the `delta` system user - [ ] ACME SSL certificate auto-renewal for `delta.barrettruth.com` - [ ] `Strict-Transport-Security` header via nginx - [ ] `X-Content-Type-Options: nosniff` header - [ ] `X-Frame-Options: DENY` header **Nice to have:** - [ ] Account lockout after N failed login attempts - [ ] Session expiry cleanup (cron to delete expired sessions from DB) - [ ] Audit log for auth events (login, logout, API key use) - [ ] Content Security Policy header - [ ] Consider invite-only registration (#24) ## Context Self-hosted on Netcup VPS behind nginx + ACME. Single user initially but friends may want accounts. The app is internet-accessible.

Rows
Columns

Security hardening before production use #25

Problem

Open Items

Context