floci-ui

Files

T

History

Zakaria c5a2fc9105 fix(api): block open redirects, add health check and body limits, run as non-root

- safeReturnTo resolves the target against a placeholder origin and rejects
  backslashes and control characters, so `/\evil.example` and similar
  payloads can no longer redirect off-site after sign-in.
- Add a real unauthenticated /api/health and answer unknown /api/* paths
  with a JSON 404 instead of the SPA shell.
- Limit request bodies: 16 KB for /api/auth/* (read before a session
  exists), 128 MB for resource create/update and uploads, 10 MB elsewhere.
- Run the production image as an unprivileged user and add a Docker
  HEALTHCHECK against /api/health.

2026-10-23 10:43:41 -04:00

public

feat(frontend): add a terminal theme and three-way theme switcher

2026-10-23 10:12:41 -04:00

scripts

feat: added a login page with Authentik authentication

2026-10-16 19:35:27 -04:00

src

fix(api): block open redirects, add health check and body limits, run as non-root

2026-10-23 10:43:41 -04:00

Dockerfile

first commit