4 Commits

Author	SHA1	Message	Date
Ralksta	13fcfe8436	Fix IP spoofing vulnerability in rate limiter by prioritizing request.ip (#132) ... Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>	2026-04-21 22:51:35 +02:00
Ralksta	b8833b4e60	🛡️ Fix global DoS vulnerability in rate limiter (FIFO eviction) ... Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>	2026-04-01 12:45:46 +02:00
ralksta	6c20218369	security: fix XSS in map popups, refactor HeroTextContent, add evict test ... - escapeHtml() in MapView.tsx sanitises city/country/url/name before HTML injection - HeroTextContent extracted to top-level component with explicit props (was nested inside async Server Component) - rate-limit.test.ts: add evictIfFull stress test (6/6 pass)	2026-03-13 12:52:09 +01:00
ralksta	a0ee0ff433	chore: production readiness audit ... - Move plans/ to dev-docs/, delete unused scaffold SVGs - Create .dockerignore, rename container to immich-folio - Extract BackLink component and toPhotoItems() helper in page.tsx - Add keyboard accessibility (role=button, tabIndex, onKeyDown) to PhotoGrid - Add aria-label to Lightbox EXIF toggle - Fix React lint: replace setState-in-effect with useState initializer - Add rate limiting to /api/auth (brute-force protection, 10 RPM) - Add HSTS and X-DNS-Prefetch-Control security headers - Add Secure flag to auth cookie in production - New unit tests: rate-limit.test.ts (5), auth.test.ts (12) - All 47 tests pass, 0 lint errors, build clean	2026-02-15 11:23:51 +01:00