bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: round 1 — quick wins (rate limiting, headers, mass assignment, logging)

Browse Source 
- Add throttle middleware to login (5/min), portal/token-auth (10/min),
  volunteer-register (5/min), and invitation routes (10/min)
- Set Sanctum token expiration to 7 days
- Remove billing_status from UpdateOrganisationRequest (super_admin only)
- Revoke all Sanctum tokens on password reset
- Strengthen password rules: min 8 chars, mixed case, numbers
- Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options,
  HSTS, Referrer-Policy, Permissions-Policy)
- Fix open redirect on all 3 login pages (validate ?to= starts with /)
- Set APP_DEBUG=false in .env.example
- Log failed login attempts with email, IP, user-agent
- Log authorization failures (403) with user, IP, path, method
- Harden mass assignment: remove user_id from Person, audit fields from
  ShiftAssignment, system fields from UserInvitation $fillable
- Replace real DB records with factory make() in mail preview routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 01:34:51 +02:00
parent 72120969c6
commit 1028498705
30 changed files with 235 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
api/tests/Feature/Api/V1/PasswordResetTest.php
View File

@@ -85,8 +85,8 @@ class PasswordResetTest extends TestCase
$response = $this->postJson('/api/v1/auth/reset-password', [
'token' => $token,
'email' => 'jan@voorbeeld.nl',
'password' => 'nieuwwachtwoord123',
'password_confirmation' => 'nieuwwachtwoord123',
'password' => 'NieuwWachtwoord1',
'password_confirmation' => 'NieuwWachtwoord1',
]);
$response->assertOk();
@@ -94,7 +94,7 @@ class PasswordResetTest extends TestCase
// Verify password was actually changed
$user->refresh();
$this->assertTrue(Hash::check('nieuwwachtwoord123', $user->password));
$this->assertTrue(Hash::check('NieuwWachtwoord1', $user->password));
}
public function test_reset_password_with_invalid_token_returns_422(): void
@@ -104,8 +104,8 @@ class PasswordResetTest extends TestCase
$response = $this->postJson('/api/v1/auth/reset-password', [
'token' => 'invalid-token-here',
'email' => 'jan@voorbeeld.nl',
'password' => 'nieuwwachtwoord123',
'password_confirmation' => 'nieuwwachtwoord123',
'password' => 'NieuwWachtwoord1',
'password_confirmation' => 'NieuwWachtwoord1',
]);
$response->assertStatus(422);
@@ -120,7 +120,7 @@ class PasswordResetTest extends TestCase
$response = $this->postJson('/api/v1/auth/reset-password', [
'token' => $token,
'email' => 'jan@voorbeeld.nl',
'password' => 'nieuwwachtwoord123',
'password' => 'NieuwWachtwoord1',
]);
$response->assertStatus(422);