fix(security): add TLS MinVersion, security headers, and request body limits
cognitive committed
Mar 5, 2026 at 02:26 UTC
5f33f61a367e459f50078f5028f22199d678d99f
2 files changed
+13
-1
cmd/relay-server/serve.go
+10
-1
@@ -121,15 +121,24 @@ func serveAPI(addr string, serv *portal.RelayServer, admin *Admin, frontend *Fro
121
appMux.ServeHTTP(w, r)
122
})
123
124
+ // Add security headers middleware
125
+ secureHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
126
+ w.Header().Set("X-Content-Type-Options", "nosniff")
127
+ w.Header().Set("X-Frame-Options", "DENY")
128
+ w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
129
+ handler.ServeHTTP(w, r)
130
+ })
131
+
132
srv := &http.Server{
133
Addr: addr,
126
- Handler: handler,
134
+ Handler: secureHandler,
135
ReadHeaderTimeout: 5 * time.Second,
136
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
137
}
138
acmeManager := serv.GetACMEManager()
139
rootHost := types.PortalRootHost(cfg.PortalURL)
140
srv.TLSConfig = &tls.Config{
141
+ MinVersion: tls.VersionTLS12,
142
ClientAuth: tls.RequestClientCert,
143
GetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
144
serverName := strings.TrimSpace(strings.ToLower(hello.ServerName))
portal/admin/handler.go
+3
@@ -214,6 +214,7 @@ func (h *Handler) handleLogin(w http.ResponseWriter, r *http.Request) {
214
}
215
216
var req types.AdminLoginRequest
217
+ r.Body = http.MaxBytesReader(w, r.Body, 1<<16)
218
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
219
h.writeAPIError(w, http.StatusBadRequest, "invalid_request", "invalid request body")
220
return
@@ -262,6 +263,7 @@ func (h *Handler) handleApprovalModeRequest(w http.ResponseWriter, r *http.Reque
263
})
264
case http.MethodPost:
265
var req types.AdminApprovalModeRequest
266
+ r.Body = http.MaxBytesReader(w, r.Body, 1<<16)
267
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
268
h.writeAPIError(w, http.StatusBadRequest, "invalid_request", "invalid request body")
269
return
@@ -447,6 +449,7 @@ func (h *Handler) handleLeaseBPSRequest(w http.ResponseWriter, r *http.Request,
449
switch r.Method {
450
case http.MethodPost:
451
var req types.AdminBPSRequest
452
+ r.Body = http.MaxBytesReader(w, r.Body, 1<<16)
453
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
454
h.writeAPIError(w, http.StatusBadRequest, "invalid_request", "invalid request body")
455
return