Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CSP header and session rotation on login

Browse Source 
Content-Security-Policy: default-src 'self'; restricts external resource loading. Session rotation: delete all existing sessions for a user on login, so re-logging invalidates any leaked tokens.
This commit is contained in:
Zaki
2026-05-09 22:24:08 +01:00
parent 4ddf2e9be6
commit 46d7ca3694
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api.php
+4
View File
@@ -14,6 +14,7 @@ set_exception_handler(function($e) use ($logFile) {
header('Content-Type: application/json'); header('Content-Type: application/json');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains'); header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'");
$origin = $_SERVER['HTTP_ORIGIN'] ?? ''; $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if ($origin && preg_match('#^https?://(localhost|127\.0\.0\.1)(:\d+)?$#', $origin)) { if ($origin && preg_match('#^https?://(localhost|127\.0\.0\.1)(:\d+)?$#', $origin)) {
@@ -297,6 +298,9 @@ try {
$upd->execute(); $upd->execute();
} }
clearAttempts($db); clearAttempts($db);
$delSessions = $db->prepare('DELETE FROM sessions WHERE user_id=:uid');
$delSessions->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
$delSessions->execute();
$defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal']; $defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
$stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)'); $stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
foreach ($defaultFolders as $name) { foreach ($defaultFolders as $name) {