Emanuel Almeida
f1756829af
HIGH-SEVERITY FIXES (Fase 2): 1. Rate Limiting (Vulnerabilidade 2.1) - express-rate-limit: 100 req/15min (prod), 1000 req/15min (dev) - Applied to all /api/* routes - Standard headers for retry-after 2. CORS Restrictions (Vulnerabilidade 2.2) - Whitelist: dashboard.descomplicar.pt, desk.descomplicar.pt - Localhost only in development - CORS blocking logs 3. Input Validation with Zod (Vulnerabilidade 2.4) - Generic validateRequest() middleware - Schemas: WordPress Monitor, server metrics, dashboard, financial - Applied to api/routes/wp-monitor.ts POST endpoint - Detailed field-level error messages 4. Backend Authentication OIDC (Vulnerabilidade 2.5 - OPTIONAL) - Enabled via OIDC_ENABLED=true - Bearer token validation on all APIs - Backward compatible (disabled by default) 5. SSH Key-Based Auth Migration (Vulnerabilidade 2.6) - Script: /media/ealmeida/Dados/Dev/ClaudeDev/migrate-ssh-keys.sh - Generates ed25519 key, copies to 6 servers - Instructions to remove passwords from .env - .env.example updated with SSH_PRIVATE_KEY_PATH 6. Improved Error Handling (Vulnerabilidade 2.5) - Unique error IDs (UUID) for tracking - Structured JSON logs in production - Stack traces blocked in production - Generic messages to client FILES CHANGED: - api/server.ts - Complete refactor with all security improvements - api/middleware/validation.ts - NEW: Zod middleware and schemas - api/routes/wp-monitor.ts - Added Zod validation on POST - .env.example - Complete security documentation - CHANGELOG.md - Full documentation of 9 fixes (3 critical + 6 high) - package.json + package-lock.json - New dependencies DEPENDENCIES ADDED: - express-rate-limit@7.x - zod@3.x - express-openid-connect@2.x AUDIT STATUS: - npm audit: 0 vulnerabilities - Hook Regra #47: PASSED PROGRESS: - Phase 1 (Critical): 3/3 ✅ COMPLETE - Phase 2 (High): 6/6 ✅ COMPLETE - Phase 3 (Medium): 0/6 - Next - Phase 4 (Low): 0/5 - Next Related: AUDIT-REPORT.md vulnerabilities 2.1, 2.2, 2.4, 2.5, 2.6 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
74 lines
2.5 KiB
Markdown
Executable File
74 lines
2.5 KiB
Markdown
Executable File
# React + TypeScript + Vite
|
|
|
|
This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
|
|
|
|
Currently, two official plugins are available:
|
|
|
|
- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
|
|
- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
|
|
|
|
## React Compiler
|
|
|
|
The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
|
|
|
|
## Expanding the ESLint configuration
|
|
|
|
If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
|
|
|
|
```js
|
|
export default defineConfig([
|
|
globalIgnores(['dist']),
|
|
{
|
|
files: ['**/*.{ts,tsx}'],
|
|
extends: [
|
|
// Other configs...
|
|
|
|
// Remove tseslint.configs.recommended and replace with this
|
|
tseslint.configs.recommendedTypeChecked,
|
|
// Alternatively, use this for stricter rules
|
|
tseslint.configs.strictTypeChecked,
|
|
// Optionally, add this for stylistic rules
|
|
tseslint.configs.stylisticTypeChecked,
|
|
|
|
// Other configs...
|
|
],
|
|
languageOptions: {
|
|
parserOptions: {
|
|
project: ['./tsconfig.node.json', './tsconfig.app.json'],
|
|
tsconfigRootDir: import.meta.dirname,
|
|
},
|
|
// other options...
|
|
},
|
|
},
|
|
])
|
|
```
|
|
|
|
You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
|
|
|
|
```js
|
|
// eslint.config.js
|
|
import reactX from 'eslint-plugin-react-x'
|
|
import reactDom from 'eslint-plugin-react-dom'
|
|
|
|
export default defineConfig([
|
|
globalIgnores(['dist']),
|
|
{
|
|
files: ['**/*.{ts,tsx}'],
|
|
extends: [
|
|
// Other configs...
|
|
// Enable lint rules for React
|
|
reactX.configs['recommended-typescript'],
|
|
// Enable lint rules for React DOM
|
|
reactDom.configs.recommended,
|
|
],
|
|
languageOptions: {
|
|
parserOptions: {
|
|
project: ['./tsconfig.node.json', './tsconfig.app.json'],
|
|
tsconfigRootDir: import.meta.dirname,
|
|
},
|
|
// other options...
|
|
},
|
|
},
|
|
])
|
|
```
|