Security/critical fixes #4

Merged

rmcampos merged 4 commits from security/critical-fixes into main 2026-06-29 19:23:42 +00:00

Conversation 0 Commits 4 Files Changed 26

+179 -129

rmcampos commented 2026-06-29 17:42:02 +00:00

Owner

Copy Link

Copy Source

What

• Addressing security issues: critical and not so critical (more fixed will be pushed soon)

Why

• The app needs to be secure and safe.

Mood

## What - Addressing security issues: critical and not so critical (more fixed will be pushed soon) ## Why - The app needs to be secure and safe. ## Mood <img width="200" src="https://media2.giphy.com/media/CSpfd57m9WGHnxMWXm/100.webp?cid=36b14facw100seggylsefdj0ap2oopoux3bn3jn6qu59xggq&ep=v1_gifs_search&rid=100.webp&ct=g"/>

rmcampos added 2 commits 2026-06-29 17:42:03 +00:00

chore: address security items 06fc1a432e

security: fix short-term priority vulnerabilities ... 231dd7ed1a

- CR-7: replace deterministic UUID v5 (SHA-1 of email) with
  UUID.randomUUID() for email confirmation tokens — prevents offline
  token computation from a known email address
- CR-10: disable source maps in production Vite build
- H-1: reduce JWT lifetime from 7 days to 30 minutes; add 25-minute
  periodic refresh interval in AuthProvider to keep active sessions alive
- H-2/H-6: require currentPassword verification before allowing email
  or password changes in patchUserInfo
- H-5: fix brute force protection anchor point — compare oldest of the
  3 failed attempts against now() instead of the most recent attempt
- H-10: add @Size constraints to NoteRequest, NotePatchRequest,
  TaskRequest, TaskPatchRequest; add migration restoring CHECK constraint
  on notes.description (max 5000 chars)
- M-2: catch JwtException supertype instead of only MalformedJwtException
  so expired/invalid tokens return empty instead of throwing 500
- M-3: change anyRequest().permitAll() to denyAll() in SecurityConfig so
  future endpoints are denied by default
- M-8: increase BCrypt cost factor from 10 to 12 per OWASP recommendation
- M-14/M-15: set include-message: never and log level INFO for all profiles

Deferred to separate PR: CR-8 (JWT HttpOnly cookie) — requires
coordinated CORS/cookie-domain config decision for the production domain
topology and coordinated backend + frontend changes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rmcampos added 1 commit 2026-06-29 18:19:32 +00:00

test: fix test cases ee39021ea8

rmcampos added 1 commit 2026-06-29 18:44:02 +00:00

chore: use 50000 instead of 5000 for data constraint fedbf30b2e

rmcampos merged commit 169f07801a into main 2026-06-29 19:23:42 +00:00

rmcampos deleted branch security/critical-fixes 2026-06-29 19:23:42 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

rmcampos (Ricardo Campos)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rmcampos/tasknote#4