Zakaria/floci-ui
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(api): block open redirects, add health check and body limits, run as non-root #4

Merged
Zakaria merged 1 commits from fix/api-hardening into main 2026-10-23 14:59:32 +00:00
Conversation 0 Commits 1 Files Changed 5
+110 -2
Zakaria commented 2026-10-23 14:59:29 +00:00
Owner
Copy Link
Copy Source
  • safeReturnTo resolves the target against a placeholder origin and rejects
    backslashes and control characters, so /\evil.example and similar
    payloads can no longer redirect off-site after sign-in.
  • Add a real unauthenticated /api/health and answer unknown /api/* paths
    with a JSON 404 instead of the SPA shell.
  • Limit request bodies: 16 KB for /api/auth/* (read before a session
    exists), 128 MB for resource create/update and uploads, 10 MB elsewhere.
  • Run the production image as an unprivileged user and add a Docker
    HEALTHCHECK against /api/health.
- safeReturnTo resolves the target against a placeholder origin and rejects backslashes and control characters, so `/\evil.example` and similar payloads can no longer redirect off-site after sign-in. - Add a real unauthenticated /api/health and answer unknown /api/* paths with a JSON 404 instead of the SPA shell. - Limit request bodies: 16 KB for /api/auth/* (read before a session exists), 128 MB for resource create/update and uploads, 10 MB elsewhere. - Run the production image as an unprivileged user and add a Docker HEALTHCHECK against /api/health.
Zakaria added 1 commit 2026-10-23 14:59:29 +00:00
fix(api): block open redirects, add health check and body limits, run as non-root c5a2fc9105 
- safeReturnTo resolves the target against a placeholder origin and rejects
  backslashes and control characters, so `/\evil.example` and similar
  payloads can no longer redirect off-site after sign-in.
- Add a real unauthenticated /api/health and answer unknown /api/* paths
  with a JSON 404 instead of the SPA shell.
- Limit request bodies: 16 KB for /api/auth/* (read before a session
  exists), 128 MB for resource create/update and uploads, 10 MB elsewhere.
- Run the production image as an unprivileged user and add a Docker
  HEALTHCHECK against /api/health.
Zakaria merged commit f5e70a78d8 into main 2026-10-23 14:59:32 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Zakaria (authentik Default Admin)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Zakaria/floci-ui#4
Delete Branch "fix/api-hardening"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?