Joshua Ryder
2ff493d804
Security Improvements: - Auto-generate AUTH_SECRET and admin credentials on first launch - Cryptographically secure random generation - Stored in database for persistence - Logged once to container logs for admin retrieval - Implement CSRF protection with double-submit cookie pattern - Three-way validation: cookie, header, and session database - Automatic client-side injection via plugin - Server middleware for automatic validation - Zero frontend code changes required - Add session fixation prevention with automatic invalidation - Regenerate sessions on password changes - Keep current session active, invalidate others on profile password change - Invalidate ALL sessions on forgot-password reset - Invalidate ALL sessions on admin password reset - Upgrade password reset codes to 8-char alphanumeric - Increased from 1M to 1.8 trillion combinations - Uses crypto.randomInt() for cryptographic randomness - Excluded confusing characters (I, O) for better UX - Case-insensitive verification - Implement dual-layer account lockout - IP-based rate limiting (existing) - Per-account lockout: 10 attempts = 30 min lock - Automatic unlock after expiration - Admin manual unlock via UI - Visual status indicators in users table Database Changes: - Add csrf_token column to sessions table - Add failed_login_attempts and locked_until columns to users table - Add settings table for persistent AUTH_SECRET storage - All migrations backward-compatible with try-catch New Files: - server/utils/csrf.ts - CSRF protection utilities - server/middleware/csrf.ts - Automatic CSRF validation middleware - plugins/csrf.client.ts - Automatic CSRF header injection - server/api/users/unlock/[id].post.ts - Admin unlock endpoint Modified Files: - server/utils/database.ts - Core security functions and schema updates - server/utils/email.ts - Enhanced reset code generation - server/api/auth/login.post.ts - CSRF + account lockout logic - server/api/auth/register.post.ts - CSRF token generation - server/api/auth/logout.post.ts - CSRF cookie cleanup - server/api/auth/reset-password.post.ts - Session invalidation - server/api/auth/verify-reset-code.post.ts - Case-insensitive codes - server/api/profile/update.put.ts - Session invalidation on password change - server/api/users/password/[id].put.ts - Session invalidation on admin reset - pages/users.vue - Lock status display and unlock functionality - docker-compose.yml - Removed default credentials - nuxt.config.ts - Support auto-generation All changes follow OWASP best practices and are production-ready. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
47 lines
1.7 KiB
TypeScript
47 lines
1.7 KiB
TypeScript
// https://nuxt.com/docs/api/configuration/nuxt-config
|
|
export default defineNuxtConfig({
|
|
compatibilityDate: '2024-04-03',
|
|
devtools: { enabled: true },
|
|
|
|
modules: [
|
|
'@nuxtjs/tailwindcss'
|
|
],
|
|
|
|
app: {
|
|
head: {
|
|
title: 'New Life Christian Church - Sermons',
|
|
meta: [
|
|
{ charset: 'utf-8' },
|
|
{ name: 'viewport', content: 'width=device-width, initial-scale=1' },
|
|
{ name: 'description', content: 'Weekly sermons from New Life Christian Church' }
|
|
],
|
|
link: [
|
|
{ rel: 'icon', type: 'image/x-icon', href: '/logos/favicon.ico' },
|
|
{ rel: 'preconnect', href: 'https://fonts.googleapis.com' },
|
|
{ rel: 'preconnect', href: 'https://fonts.gstatic.com', crossorigin: '' },
|
|
{ rel: 'stylesheet', href: 'https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap' }
|
|
]
|
|
}
|
|
},
|
|
|
|
css: ['~/assets/css/main.css'],
|
|
|
|
runtimeConfig: {
|
|
// AUTH_SECRET is now auto-generated and stored in database
|
|
// Only used if explicitly provided (for advanced users who want manual control)
|
|
authSecret: process.env.AUTH_SECRET || '',
|
|
// Admin credentials - auto-generated on first launch if not provided
|
|
adminUsername: process.env.ADMIN_USERNAME || 'admin',
|
|
adminPassword: process.env.ADMIN_PASSWORD || '',
|
|
// Email configuration
|
|
emailHost: process.env.EMAIL_HOST || 'smtp.example.com',
|
|
emailPort: process.env.EMAIL_PORT || '587',
|
|
emailUser: process.env.EMAIL_USER || 'noreply@example.com',
|
|
emailPassword: process.env.EMAIL_PASSWORD || '',
|
|
emailFrom: process.env.EMAIL_FROM || 'New Life Christian Church <noreply@example.com>',
|
|
public: {
|
|
siteUrl: process.env.SITE_URL || 'http://localhost:3000'
|
|
}
|
|
}
|
|
})
|