Fix high and medium security vulnerabilities

CSRF: upgrade session cookie sameSite from 'lax' to 'strict'.

Rate limiting: login endpoint now blocks an IP after 10 failed attempts
in a 15-minute window; resets on success. In-memory, no new dependency.

SESSION_SECRET: server exits at startup when NODE_ENV=production and
SESSION_SECRET is unset. docker-compose.yml updated to pass it via env;
.env.example added with generation instructions.

Security headers: add X-Content-Type-Options, X-Frame-Options, and
Referrer-Policy to all responses.

Sensitive data: routing_number and account_number are now omitted from
GET /api/account/:id responses for non-admin users.

Image size: logo upload capped at 512 KB in the account PUT handler.

Amount validation: checks (POST/PUT) and deposit items (POST/PUT) now
reject non-finite and non-positive amounts.

QBO import: uploaded file is rejected if its MIME type is not text or
a known CSV variant.

This commit is contained in:

Steve Dogiakos

2026-03-20 08:21:23 -06:00

parent 0f00624e61

commit 2939bfa608

8 changed files with 127 additions and 13 deletions

									
										.env.example
									
		+6
		
												View File
												
				@@ -0,0 +1,6 @@

				# Copy to .env and fill in values before starting in production.

				# Generate SESSION_SECRET with: openssl rand -hex 32

				SESSION_SECRET=replace-with-a-random-64-character-hex-string

				PORT=3000

				DB_PATH=/app/data/check-printing.db