fix: audit critique - sécurité, UX mobile et qualité de code - #38
Closed
mcinquin wants to merge 1 commit into
Closed
fix: audit critique - sécurité, UX mobile et qualité de code#38mcinquin wants to merge 1 commit into
mcinquin wants to merge 1 commit into
Conversation
Security: - Add CSRF protection (rejectCrossSiteMutation) to login and bootstrap routes - Prevent user enumeration via timing-safe dummy password hash on failed lookups - Add request body size limit (512KB) guard on mutation API routes - Minimize health endpoint info leakage (no longer exposes table-level details) - Move card DELETE id from query params to request body for CSRF consistency - Harden CSP nonce generation using crypto.getRandomValues (16 bytes) Mobile UX: - Add viewport meta tag with device-width, maximumScale=1, viewportFit=cover - Add touch-action: manipulation to prevent 300ms tap delay - Remove -webkit-tap-highlight-color flash on mobile - Set min font-size 16px on inputs to prevent iOS Safari auto-zoom - Make card-form dialog full-screen on mobile viewports Performance: - Add loading.tsx skeleton screens for dashboard, collection, and player routes Code quality: - Extract shared Combobox component from card-form and admin-cards-section - Add payloadTooLarge translation key (fr/en)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit critique du projet HobbyHoops
Suite à un audit complet du code source, cette PR apporte des améliorations dans trois axes : sécurité, UX mobile et qualité de code.
Sécurité
POST /api/auth/loginetPOST /api/auth/bootstrapne vérifiaient pas l'origine de la requête (pas de protection CSRF)rejectCrossSiteMutationsur ces deux routes pour prévenir les attaques CSRF de type "login CSRF"dummyVerifyqui exécute un hash scrypt factice quand l'utilisateur n'existe pas, rendant le temps de réponse constantrejectOversizedBody(512 KB max) sur toutes les routes de mutation (POST/PUT/PATCH /api/cards,PATCH /api/references)/api/healthexposait des détails internes (existence de données par table){ status: "healthy" }ou{ status: "degraded" }DELETE /api/cardsutilisait un paramètre GET (?id=...) — incompatible avec la protection CSRFsec-fetch-sitesur certains navigateurs{ id: "..." }avec fallback sur query params pour rétro-compatibilitécrypto.getRandomValues(new Uint8Array(16))(128 bits d'entropie pure)UX Mobile
viewportexport Next.js avecwidth: device-width,initialScale: 1,maximumScale: 1,viewportFit: covertouch-action: manipulationsur<html>-webkit-tap-highlight-color: transparentsur<body>font-size: 16pxminimum surinput,select,textareamax-h-dvh,inset-0) et reste centré sur desktopPerformance
loading.tsxavec des squelettes animés pour les routes dashboard, collection et joueursQualité de code
card-form.tsx(~100 lignes) etadmin-cards-section.tsx(~100 lignes)src/components/ui/combobox.tsx, utilisé par les deux fichiersFichiers modifiés
src/app/api/auth/login/route.ts— CSRF + timing-safesrc/app/api/auth/bootstrap/route.ts— CSRFsrc/app/api/cards/route.ts— body size limit + DELETE via bodysrc/app/api/references/route.ts— body size limitsrc/app/api/health/route.ts— réponse minimalesrc/lib/password.ts—dummyVerify()src/lib/request-guard.ts—rejectOversizedBody()src/lib/csp.ts— nonce viagetRandomValuessrc/lib/db.ts/src/lib/data.ts— signaturegetDatabaseHealthsimplifiéesrc/app/layout.tsx— viewport metasrc/app/globals.css— optimisations touch mobilesrc/components/ui/combobox.tsx— nouveau composant partagésrc/components/card-form.tsx— utiliseCombobox+ dialog mobilesrc/components/admin/admin-cards-section.tsx— utiliseCombobox+ DELETE bodysrc/app/(app)/loading.tsx— skeleton dashboardsrc/app/(app)/collection/loading.tsx— skeleton collectionsrc/app/(app)/player/loading.tsx— skeleton joueursmessages/fr.json/messages/en.json— clépayloadTooLarge