Feat/security - #56
Merged
Merged
Conversation
- Updated installation requirements to include `fastapi-redis-sdk` for Redis support. - Introduced `CacheConfig` for managing caching and rate limiting configurations. - Implemented Redis-backed login rate limiting with graceful degradation to in-memory fallback. - Added Redis caching for list and detail endpoints, including automatic cache headers. - Enhanced documentation to cover new Redis features and usage. - Created tests for Redis caching and rate limiting functionalities.
…gainst privilege escalation, and address XSS vulnerabilities in admin interface. Add regression tests for sensitive fields, stale JWTs, and mass assignment protections.
- Implement token validation to ensure tokens are not valid after a password change. - Introduce access token TTL configuration and enforce limits on API token usage. - Add privileged assignment fields to prevent unauthorized writes to sensitive user model fields. - Improve file storage backend to enforce size limits and prevent path traversal vulnerabilities. - Update JSON body parsing to ensure validation rules are consistently applied across API requests. - Add regression tests for API validation bypass, token revocation, and storage traversal vulnerabilities.
- Introduced `get_client_ip` function to resolve client IPs behind reverse proxies, ensuring that `X-Forwarded-For` headers are only trusted when the immediate peer is a configured trusted proxy. - Updated rate limiting logic in authentication endpoints to count failed attempts per (client IP, email) for token requests, and per client IP for refresh and logout requests. - Refactored `RateLimiter` to be asyncio-safe, replacing threading locks with asyncio locks. - Added configuration for trusted proxies in `AuthConfig`, allowing for flexible deployment scenarios. - Enhanced middleware to utilize the new IP resolution logic for audit context. - Updated tests to cover new rate limiting behavior and client IP resolution scenarios.
…port/import modules - refactor password hashing to use bcrypt for backup codes, maintaining legacy SHA256 support - enforce session security by requiring 'iat' claim in tokens and ensuring unique session IDs on login - implement formula injection prevention in CSV/Excel exports - restrict import fields to prevent sensitive data exposure and ensure proper permissions for export/import actions - improve error handling with appropriate status codes for unauthorized access - add tests for new security features and ensure legacy compatibility
…QLAlchemy backend
…ntication backend for ORM-agnostic queries
- Updated materialization of user-related models to derive foreign key types from referenced models, ensuring consistency in primary key types. - Introduced a new mapping for built-in schemas to facilitate foreign key type resolution. - Refactored user schemas to use string types for user IDs, aligning with UUID and string-based implementations. - Added tests to validate foreign key type derivation and ensure correct behavior with custom authentication models. - Improved security documentation and added a TODO file for ongoing security remediation efforts. - Updated documentation navigation to include a new guide on custom authentication models.
…assword' across models and views
…sword' for consistency
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.