Merge pull request #1 from adnope/security_tweaks

Author: adnope

.env.example

@@ -1,6 +1,8 @@
 PORT=8080
 DATA_DIR=./data
 SESSION_TTL=30d
+COOKIE_SECURE=false
+TRUSTED_PROXIES=
 CHAT_PAGE_SIZE=100
 HISTORY_PAGE_SIZE=100
 SEARCH_RESULT_LIMIT=30

README.md

@@ -70,6 +70,8 @@ Environment variables:
 PORT=8080
 DATA_DIR=./data
 SESSION_TTL=30d
+COOKIE_SECURE=false
+TRUSTED_PROXIES=
 CHAT_PAGE_SIZE=100
 HISTORY_PAGE_SIZE=100
 SEARCH_RESULT_LIMIT=30
@@ -81,6 +83,7 @@ UPLOAD_CONCURRENCY=1
 ```
 
 Size values accept bytes or `KB`, `MB`, `GB`, `TB`, `KiB`, `MiB`, `GiB`, `TiB`.
+`UPLOAD_CONCURRENCY` is capped at 10. Set `COOKIE_SECURE=true` when serving only over HTTPS. Set `TRUSTED_PROXIES` to comma-separated proxy IPs/CIDRs only when a trusted reverse proxy sets forwarding headers.
 
 Create local env file:
 

cmd/ephemeral/main.go

@@ -104,18 +104,20 @@ func main() {
 			MaxUploadBytes:      cfg.MaxUploadBytes,
 			TextPreviewMaxBytes: cfg.TextPreviewMaxBytes,
 			UploadConcurrency:   cfg.UploadConcurrency,
+			CookieSecure:        cfg.CookieSecure,
 		},
 	)
 
 	r := chi.NewRouter()
 
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.RequestID)
-	r.Use(middleware.RealIP)
 
+	r.Use(mw.TrustedRealIP(cfg.TrustedProxies))
+	r.Use(mw.SecurityHeaders)
 	r.Use(mw.RequestLogger(logger))
 	r.Use(mw.RateLimit(100, time.Minute))
-	r.Use(mw.SessionAuth(sessionRepo, cfg.SessionTTL))
+	r.Use(mw.SessionAuth(sessionRepo, cfg.SessionTTL, cfg.CookieSecure))
 
 	staticSubFS, err := fs.Sub(web.FS, "static")
 	if err != nil {

docker-compose.yml

@@ -13,6 +13,8 @@ services:
       - PORT=8080
       - DATA_DIR=/app/data
       - SESSION_TTL=${SESSION_TTL:-30d}
+      - COOKIE_SECURE=${COOKIE_SECURE:-false}
+      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-}
       - CHAT_PAGE_SIZE=${CHAT_PAGE_SIZE:-100}
       - HISTORY_PAGE_SIZE=${HISTORY_PAGE_SIZE:-100}
       - SEARCH_RESULT_LIMIT=${SEARCH_RESULT_LIMIT:-30}

docs/API.md

@@ -6,10 +6,11 @@ Ephemeral provides a minimal set of authenticated endpoints for sharing text, up
 
 All protected endpoints require a valid `session_token` cookie.
 
-Sessions are rolling sessions. When a session is close to expiry, authenticated requests refresh the session expiry and reset the cookie max age. The session TTL is configured with:
+Sessions are rolling sessions. When a session is close to expiry, authenticated requests refresh the session expiry and reset the cookie max age. The session TTL and secure-cookie behavior are configured with:
 
 ```env
 SESSION_TTL=30d
+COOKIE_SECURE=false
 ```
 
 Supported examples:
@@ -37,6 +38,7 @@ UPLOAD_CONCURRENCY=1
 ```
 
 Size values accept bytes or `KB`, `MB`, `GB`, `TB`, `KiB`, `MiB`, `GiB`, `TiB`.
+JSON request bodies for JSON endpoints are limited to 64 KiB. `UPLOAD_CONCURRENCY` is enforced server-side and capped at 10.
 
 ## JSON API Conventions
 
@@ -404,6 +406,7 @@ Returns the file content using `http.ServeFile`.
 
 - Supports filenames with spaces and Unicode characters.
 - Rejects unsafe paths such as absolute paths or `..`.
+- Active document uploads such as HTML, SVG, XML, and XHTML are served with a sandbox Content Security Policy when opened directly.
 
 ---
 

go.mod

@@ -4,7 +4,7 @@ go 1.26
 
 require (
 	github.com/go-chi/chi/v5 v5.1.0
-	golang.org/x/crypto v0.22.0
+	golang.org/x/crypto v0.51.0
 	modernc.org/sqlite v1.50.0
 )
 
@@ -14,7 +14,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
 	modernc.org/libc v1.72.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -14,15 +14,15 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
 golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=

internal/config/config.go

@@ -3,16 +3,21 @@ package config
 import (
 	"fmt"
 	"math"
+	"net/netip"
 	"os"
 	"strconv"
 	"strings"
 	"time"
 )
 
+const MaxUploadConcurrency = 10
+
 type Config struct {
 	Port                int
 	DataDir             string
 	SessionTTL          time.Duration
+	CookieSecure        bool
+	TrustedProxies      []netip.Prefix
 	ChatPageSize        int
 	HistoryPageSize     int
 	SearchResultLimit   int
@@ -61,6 +66,18 @@ func Load() (*Config, error) {
 		cfg.SessionTTL = ttl
 	}
 
+	if err := loadBool("COOKIE_SECURE", &cfg.CookieSecure); err != nil {
+		return nil, err
+	}
+
+	if v := os.Getenv("TRUSTED_PROXIES"); v != "" {
+		proxies, err := parseTrustedProxies(v)
+		if err != nil {
+			return nil, fmt.Errorf("config: invalid TRUSTED_PROXIES %q: %w", v, err)
+		}
+		cfg.TrustedProxies = proxies
+	}
+
 	if err := loadPositiveInt("CHAT_PAGE_SIZE", &cfg.ChatPageSize); err != nil {
 		return nil, err
 	}
@@ -82,7 +99,7 @@ func Load() (*Config, error) {
 	if err := loadPositiveInt("MEDIA_WORKER_COUNT", &cfg.MediaWorkerCount); err != nil {
 		return nil, err
 	}
-	if err := loadPositiveInt("UPLOAD_CONCURRENCY", &cfg.UploadConcurrency); err != nil {
+	if err := loadBoundedPositiveInt("UPLOAD_CONCURRENCY", &cfg.UploadConcurrency, MaxUploadConcurrency); err != nil {
 		return nil, err
 	}
 
@@ -126,6 +143,31 @@ func loadPositiveInt(name string, target *int) error {
 	return nil
 }
 
+func loadBoundedPositiveInt(name string, target *int, maxValue int) error {
+	if err := loadPositiveInt(name, target); err != nil {
+		return err
+	}
+	if *target > maxValue {
+		*target = maxValue
+	}
+	return nil
+}
+
+func loadBool(name string, target *bool) error {
+	value := os.Getenv(name)
+	if value == "" {
+		return nil
+	}
+
+	parsed, err := strconv.ParseBool(strings.TrimSpace(value))
+	if err != nil {
+		return fmt.Errorf("config: invalid %s %q: %w", name, value, err)
+	}
+
+	*target = parsed
+	return nil
+}
+
 func loadByteSize(name string, target *int64) error {
 	value := os.Getenv(name)
 	if value == "" {
@@ -144,6 +186,39 @@ func loadByteSize(name string, target *int64) error {
 	return nil
 }
 
+func parseTrustedProxies(value string) ([]netip.Prefix, error) {
+	parts := strings.Split(value, ",")
+	proxies := make([]netip.Prefix, 0, len(parts))
+	for _, part := range parts {
+		raw := strings.TrimSpace(part)
+		if raw == "" {
+			continue
+		}
+
+		if strings.Contains(raw, "/") {
+			prefix, err := netip.ParsePrefix(raw)
+			if err != nil {
+				return nil, err
+			}
+			proxies = append(proxies, prefix.Masked())
+			continue
+		}
+
+		addr, err := netip.ParseAddr(raw)
+		if err != nil {
+			return nil, err
+		}
+		addr = addr.Unmap()
+		bits := 32
+		if addr.Is6() {
+			bits = 128
+		}
+		proxies = append(proxies, netip.PrefixFrom(addr, bits))
+	}
+
+	return proxies, nil
+}
+
 func parseDurationWithDays(value string) (time.Duration, error) {
 	value = strings.TrimSpace(value)
 	if before, ok := strings.CutSuffix(value, "d"); ok {

internal/config/config_test.go

@@ -40,31 +40,45 @@ func TestLoadRuntimeTuningEnv(t *testing.T) {
 	t.Setenv("PORT", "9000")
 	t.Setenv("DATA_DIR", dataDir)
 	t.Setenv("SESSION_TTL", "2h")
+	t.Setenv("COOKIE_SECURE", "true")
+	t.Setenv("TRUSTED_PROXIES", "127.0.0.1, 10.0.0.0/8")
 	t.Setenv("CHAT_PAGE_SIZE", "25")
 	t.Setenv("HISTORY_PAGE_SIZE", "50")
 	t.Setenv("SEARCH_RESULT_LIMIT", "12")
 	t.Setenv("MAX_UPLOAD_SIZE", "64MiB")
 	t.Setenv("TEXT_PREVIEW_MAX", "512KiB")
 	t.Setenv("BODY_INDEX_MAX", "1MiB")
 	t.Setenv("MEDIA_WORKER_COUNT", "3")
-	t.Setenv("UPLOAD_CONCURRENCY", "2")
+	t.Setenv("UPLOAD_CONCURRENCY", "42")
 
 	cfg, err := Load()
 	if err != nil {
 		t.Fatalf("Load(): %v", err)
 	}
 
-	if cfg.Port != 9000 || cfg.DataDir != dataDir || cfg.SessionTTL != 2*time.Hour {
+	if cfg.Port != 9000 || cfg.DataDir != dataDir || cfg.SessionTTL != 2*time.Hour || !cfg.CookieSecure {
 		t.Fatalf("unexpected base config: %#v", cfg)
 	}
+	if len(cfg.TrustedProxies) != 2 {
+		t.Fatalf("TrustedProxies len = %d, want 2", len(cfg.TrustedProxies))
+	}
 	if cfg.ChatPageSize != 25 ||
 		cfg.HistoryPageSize != 50 ||
 		cfg.SearchResultLimit != 12 ||
 		cfg.MaxUploadBytes != 64<<20 ||
 		cfg.TextPreviewMaxBytes != 512<<10 ||
 		cfg.BodyIndexMaxBytes != 1<<20 ||
 		cfg.MediaWorkerCount != 3 ||
-		cfg.UploadConcurrency != 2 {
+		cfg.UploadConcurrency != MaxUploadConcurrency {
 		t.Fatalf("unexpected tuning config: %#v", cfg)
 	}
 }
+
+func TestLoadInvalidTrustedProxy(t *testing.T) {
+	t.Setenv("DATA_DIR", t.TempDir())
+	t.Setenv("TRUSTED_PROXIES", "not-an-ip")
+
+	if _, err := Load(); err == nil {
+		t.Fatal("Load() error = nil, want invalid trusted proxy error")
+	}
+}

internal/delivery/http/auth.go

@@ -61,7 +61,11 @@ func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
 
 	if hasJSONContentType(r) {
 		var req loginRequest
-		if err := decodeJSON(r, &req); err != nil {
+		if err := decodeJSON(w, r, &req); err != nil {
+			if errors.Is(err, errJSONBodyTooLarge) {
+				writeJSONError(w, http.StatusRequestEntityTooLarge, "payload_too_large", "JSON body too large")
+				return
+			}
 			writeJSONError(w, http.StatusBadRequest, "validation_error", "invalid JSON body")
 			return
 		}
@@ -113,7 +117,7 @@ func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	http.SetCookie(w, newSessionCookie(result.Token, result.TTL))
+	http.SetCookie(w, newSessionCookie(result.Token, result.TTL, h.settings.CookieSecure))
 	if wantsJSON(r) {
 		writeJSON(w, http.StatusOK, loginResponse{Authenticated: true})
 		return
@@ -138,13 +142,14 @@ func (h *Handler) Logout(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/login", http.StatusSeeOther)
 }
 
-func newSessionCookie(token string, ttl time.Duration) *http.Cookie {
+func newSessionCookie(token string, ttl time.Duration, secure bool) *http.Cookie {
 	return &http.Cookie{
 		Name:     sessionCookieName,
 		Value:    token,
 		Path:     "/",
 		MaxAge:   int(ttl.Seconds()),
 		HttpOnly: true,
+		Secure:   secure,
 		SameSite: http.SameSiteLaxMode,
 	}
 }