63b6cbc01d
Findings security-review P1/P2 (2026-07-03): - headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options, Referrer-Policy, HSTS doar pe HTTPS) + teste - body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul multipart/JSON; verificarea per-endpoint ramane strat 2) - imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe volumul /data - fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau AUTOPASS_SESSION_SECRET - compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa Traefik - signup fara PII in stdout: log_event in loc de print cu email (idem notify degradat) - ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona a memoriei pe IP-uri reale) - backup criptat SQLite (backup online API, gpg AES256) + verificare restore + docs/backup.md Suita completa verde: 1557 passed, 1 skipped (live). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
54 lines
2.1 KiB
Python
54 lines
2.1 KiB
Python
"""Middleware HTTP: request_id per cerere.
|
|
|
|
Fiecare raspuns primeste un header `X-Request-ID` (generat daca clientul nu trimite
|
|
unul). Pe durata cererii, id-ul e disponibil prin `observ.request_id_var` (contextvar)
|
|
in handlerul de erori si in `log_event` — fara a polua semnaturile.
|
|
|
|
Format opac, fara PII: `secrets.token_hex(8)` (16 hex). Daca clientul trimite un
|
|
`X-Request-ID`, il pastram (corelare end-to-end), dar il scurtam defensiv (max 64).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
|
|
from ..observ import request_id_var
|
|
|
|
|
|
class RequestIDMiddleware(BaseHTTPMiddleware):
|
|
async def dispatch(self, request: Request, call_next):
|
|
incoming = request.headers.get("X-Request-ID")
|
|
request_id = (incoming.strip()[:64] if incoming and incoming.strip() else secrets.token_hex(8))
|
|
token = request_id_var.set(request_id)
|
|
# Expune si pe request.state pentru handlerele care prefera accesul explicit.
|
|
request.state.request_id = request_id
|
|
try:
|
|
response = await call_next(request)
|
|
finally:
|
|
request_id_var.reset(token)
|
|
response.headers["X-Request-ID"] = request_id
|
|
return response
|
|
|
|
|
|
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
|
|
"""Headere de securitate pe TOATE raspunsurile (P1-4, hardening 2026-07-03).
|
|
|
|
HSTS se pune DOAR pe HTTPS: pe HTTP browserul l-ar ignora oricum, dar l-am
|
|
omis explicit ca sa nu sugereze o garantie falsa in dev/smoke pe HTTP simplu.
|
|
Nu suprascrie un header deja setat explicit de raspuns (setdefault).
|
|
"""
|
|
|
|
async def dispatch(self, request: Request, call_next):
|
|
response = await call_next(request)
|
|
response.headers.setdefault("X-Content-Type-Options", "nosniff")
|
|
response.headers.setdefault("X-Frame-Options", "DENY")
|
|
response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
|
|
if request.url.scheme == "https":
|
|
response.headers.setdefault(
|
|
"Strict-Transport-Security", "max-age=31536000; includeSubDomains"
|
|
)
|
|
return response
|