Skip to content

Commit 7b9701c

Browse files
claudeclaude
committed
Harden web app security
- Random secret key (env var or generated per-process, not hardcoded) - CSRF token on all POST forms with constant-time comparison - Security headers: CSP, X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - All form inputs validated against whitelists, no raw user strings reach enum lookups or int() calls - Text inputs truncated to 500 chars - Numeric inputs bounded (days 3-6, minutes 30-120, sets 0-50) - Per-session program storage replaces shared global mutable state - In-memory rate limiter (20 req/min per IP) - Debug mode off by default (env var opt-in) - Secure session cookies (HttpOnly, SameSite=Lax, optional Secure) - Error templates for 400/403/429/500 https://claude.ai/code/session_01Lo7Z7GoRzG6hZkKwrxnXVk
1 parent 2bc64f6 commit 7b9701c

3 files changed

Lines changed: 278 additions & 61 deletions

File tree

‎ironforge/templates/error.html‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>Error {{ code }} — Ironforge</title>
7+
<style>
8+
* { margin: 0; padding: 0; box-sizing: border-box; }
9+
body {
10+
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;
11+
background: #0f0f0f; color: #e0e0e0;
12+
min-height: 100vh;
13+
display: flex; flex-direction: column;
14+
align-items: center; justify-content: center;
15+
padding: 2rem;
16+
}
17+
.code { font-size: 4rem; font-weight: 700; color: #e8a832; }
18+
.msg { font-size: 1rem; color: #888; margin: 1rem 0 2rem; text-align: center; max-width: 400px; line-height: 1.5; }
19+
a {
20+
color: #e8a832; text-decoration: none;
21+
border: 1px solid #2a2a2a; padding: 0.6rem 1.5rem;
22+
border-radius: 8px; font-size: 0.9rem;
23+
}
24+
a:hover { border-color: #e8a832; }
25+
</style>
26+
</head>
27+
<body>
28+
<div class="code">{{ code }}</div>
29+
<div class="msg">{{ message }}</div>
30+
<a href="/">Back to Home</a>
31+
</body>
32+
</html>

‎ironforge/templates/index.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,7 @@ <h1>IRONFORGE</h1>
208208
<div class="progress-label" id="progress-label">Block A — Goals</div>
209209

210210
<form id="intake" action="/generate" method="POST">
211+
<input type="hidden" name="_csrf_token" value="{{ csrf_token() }}">
211212

212213
<!-- ═══ BLOCK A: GOALS ═══ -->
213214
<div class="section active" data-step="0" data-label="Block A — Goals">

0 commit comments

Comments
 (0)