Claude 3d16061709 Auth hardening: login rate-limiting + session fixation defenses ...

- login.php: Redis-backed per-IP rate limit (10 fails / 15 min lockout), keyed off CF-Connecting-IP/X-Forwarded-For so it sees the real client behind NPM; fails open if Redis is down

- login.php: session_regenerate_id(true) on successful auth (prevents session fixation)

- php.ini: session.use_strict_mode = 1 (reject unknown/attacker-supplied session IDs)

- netscan.php: constant-time hash_equals for the registration-key check (matches agent.php)

Cookie flags already HttpOnly + SameSite=Lax (verified live). Agent auth verified: missing/bad X-Agent-Key -> 401 on every machine action.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-07 20:31:57 -05:00

..

admin

Rotate agent registration key; remove key literals from public scripts/UI

2026-07-07 20:22:00 -05:00

agent

Rotate agent registration key; remove key literals from public scripts/UI

2026-07-07 20:22:00 -05:00

assets

Rotate agent registration key; remove key literals from public scripts/UI

2026-07-07 20:22:00 -05:00

.gitignore

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

.htaccess

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

api.php

Rotate agent registration key; remove key literals from public scripts/UI

2026-07-07 20:22:00 -05:00

bridge.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

index.html

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

index.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

install-agent.sh

Rotate agent registration key; remove key literals from public scripts/UI

2026-07-07 20:22:00 -05:00

login.php

Auth hardening: login rate-limiting + session fixation defenses

2026-07-07 20:31:57 -05:00

webhook.php

Test: verify auto-deploy pipeline end-to-end

2026-07-07 08:25:12 -05:00