Pouzor
6ace796c8b
C2 - JWT token was stored in localStorage (XSS-accessible):
- Switch Zustand persist storage from localStorage to sessionStorage
- Token is now scoped to the current tab and cleared on browser close
H5 - docker-compose had unsafe SECRET_KEY fallback:
- Replace ${SECRET_KEY:-change_me_in_production} with :? syntax
- Docker Compose now aborts with a clear error if SECRET_KEY is unset
M1 - Login endpoint had timing leak allowing username enumeration:
- Always call verify_password() regardless of username match
- Use hmac.compare_digest() for constant-time username comparison
- Both checks run every time; attacker cannot distinguish wrong
username from wrong password via response timing
39 lines
807 B
YAML
39 lines
807 B
YAML
services:
|
|
backend:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.backend
|
|
restart: unless-stopped
|
|
environment:
|
|
SECRET_KEY: ${SECRET_KEY:?SECRET_KEY must be set in the environment or a .env file}
|
|
SQLITE_PATH: /app/data/homelab.db
|
|
CONFIG_PATH: /app/config.yml
|
|
CORS_ORIGINS: '["http://localhost:3000"]'
|
|
volumes:
|
|
- backend_data:/app/data
|
|
- ./backend/config.yml:/app/config.yml
|
|
networks:
|
|
- homelable
|
|
# Required for ping-based status checks
|
|
cap_add:
|
|
- NET_RAW
|
|
|
|
frontend:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.frontend
|
|
restart: unless-stopped
|
|
ports:
|
|
- "3000:80"
|
|
depends_on:
|
|
- backend
|
|
networks:
|
|
- homelable
|
|
|
|
volumes:
|
|
backend_data:
|
|
|
|
networks:
|
|
homelable:
|
|
driver: bridge
|