space/jellomator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

backend: complete P0 session rotation hardening

Browse Source
This commit is contained in:
Space-Banane
2026-05-20 22:39:46 +02:00
parent 17b4793a73
commit 643785ad1e
2 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
TODO.md
View File

@@ -4,10 +4,10 @@ Concrete follow-up work for Jellomator, prioritized by implementation risk and u
## P0 - Security and Reliability
- [ ] Add session expiry and rotation.
- [x] Add session expiry and rotation.
- [x] Add `expires_at` and `last_seen_at` to `sessions`.
- [x] Reject expired tokens in `current_user`.
- [ ] Rotate session token on login and periodically on use.
- [x] Rotate session token on login and periodically on use.
- [x] Harden auth endpoints.
- [x] Add login rate limiting by IP + username pair.
- [x] Add brute-force lockout window with clear error message.