Claude 3d16061709 Auth hardening: login rate-limiting + session fixation defenses ...

- login.php: Redis-backed per-IP rate limit (10 fails / 15 min lockout), keyed off CF-Connecting-IP/X-Forwarded-For so it sees the real client behind NPM; fails open if Redis is down

- login.php: session_regenerate_id(true) on successful auth (prevents session fixation)

- php.ini: session.use_strict_mode = 1 (reject unknown/attacker-supplied session IDs)

- netscan.php: constant-time hash_equals for the registration-key check (matches agent.php)

Cookie flags already HttpOnly + SameSite=Lax (verified live). Agent auth verified: missing/bad X-Agent-Key -> 401 on every machine action.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-07 20:31:57 -05:00

..

agent.php

Rotate agent registration key; remove key literals from public scripts/UI

2026-07-07 20:22:00 -05:00

alerts.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

arc.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

auth.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

calendar_sync.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

chat.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

directives.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

do_server.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

email.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

facts_collector.php

Site Health tab: fix parkerslingshotrentals.com label + widen cards for full domain names; fix sites freshness-check interval mismatch (300s vs 180s cron) causing checks to feel far apart

2026-07-07 08:41:52 -05:00

ha.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

history.php

Fix errors unmasked by re-enabling error_reporting(E_ALL)

2026-07-07 19:43:37 -05:00

jellyfin.php

Fix errors unmasked by re-enabling error_reporting(E_ALL)

2026-07-07 19:43:37 -05:00

kb_intent_generator.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

memory.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

metrics.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

netscan.php

Auth hardening: login rate-limiting + session fixation defenses

2026-07-07 20:31:57 -05:00

network.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

news.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

planner.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

proxmox.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

sites.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

stats_cache.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

suggestions.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

system.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

tts.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00

weather.php

Adopt live production state as git baseline

2026-07-07 07:55:47 -05:00