Jason WoltjeandClaude Opus 4.5
7390cac2cc
- Token now includes HMAC binding to session ID
- Validates session binding on verification
- Adds CSRF_SECRET configuration requirement
- Requires authentication for CSRF token endpoint
- 51 new tests covering session binding security
Security: CSRF tokens are now cryptographically tied to user sessions,
preventing token reuse across sessions and mitigating session fixation
attacks.
Token format: {random_part}:{hmac(random_part + user_id, secret)}
Refs #338
Co-Authored-By: Claude Opus 4.5 <[email protected]>
114 lines
3.8 KiB
TypeScript
114 lines
3.8 KiB
TypeScript
import { Module } from "@nestjs/common";
|
|
import { APP_INTERCEPTOR, APP_GUARD } from "@nestjs/core";
|
|
import { ThrottlerModule } from "@nestjs/throttler";
|
|
import { BullModule } from "@nestjs/bullmq";
|
|
import { ThrottlerValkeyStorageService, ThrottlerApiKeyGuard } from "./common/throttler";
|
|
import { CsrfGuard } from "./common/guards/csrf.guard";
|
|
import { CsrfService } from "./common/services/csrf.service";
|
|
import { AppController } from "./app.controller";
|
|
import { AppService } from "./app.service";
|
|
import { CsrfController } from "./common/controllers/csrf.controller";
|
|
import { PrismaModule } from "./prisma/prisma.module";
|
|
import { DatabaseModule } from "./database/database.module";
|
|
import { AuthModule } from "./auth/auth.module";
|
|
import { ActivityModule } from "./activity/activity.module";
|
|
import { TasksModule } from "./tasks/tasks.module";
|
|
import { EventsModule } from "./events/events.module";
|
|
import { ProjectsModule } from "./projects/projects.module";
|
|
import { DomainsModule } from "./domains/domains.module";
|
|
import { IdeasModule } from "./ideas/ideas.module";
|
|
import { WidgetsModule } from "./widgets/widgets.module";
|
|
import { LayoutsModule } from "./layouts/layouts.module";
|
|
import { KnowledgeModule } from "./knowledge/knowledge.module";
|
|
import { UsersModule } from "./users/users.module";
|
|
import { WebSocketModule } from "./websocket/websocket.module";
|
|
import { LlmModule } from "./llm/llm.module";
|
|
import { LlmUsageModule } from "./llm-usage/llm-usage.module";
|
|
import { BrainModule } from "./brain/brain.module";
|
|
import { CronModule } from "./cron/cron.module";
|
|
import { AgentTasksModule } from "./agent-tasks/agent-tasks.module";
|
|
import { ValkeyModule } from "./valkey/valkey.module";
|
|
import { BullMqModule } from "./bullmq/bullmq.module";
|
|
import { StitcherModule } from "./stitcher/stitcher.module";
|
|
import { TelemetryModule, TelemetryInterceptor } from "./telemetry";
|
|
import { RunnerJobsModule } from "./runner-jobs/runner-jobs.module";
|
|
import { JobEventsModule } from "./job-events/job-events.module";
|
|
import { JobStepsModule } from "./job-steps/job-steps.module";
|
|
import { CoordinatorIntegrationModule } from "./coordinator-integration/coordinator-integration.module";
|
|
import { FederationModule } from "./federation/federation.module";
|
|
|
|
@Module({
|
|
imports: [
|
|
// Rate limiting configuration
|
|
ThrottlerModule.forRootAsync({
|
|
useFactory: () => {
|
|
const ttl = parseInt(process.env.RATE_LIMIT_TTL ?? "60", 10) * 1000; // Convert to milliseconds
|
|
const limit = parseInt(process.env.RATE_LIMIT_GLOBAL_LIMIT ?? "100", 10);
|
|
|
|
return {
|
|
throttlers: [
|
|
{
|
|
ttl,
|
|
limit,
|
|
},
|
|
],
|
|
storage: new ThrottlerValkeyStorageService(),
|
|
};
|
|
},
|
|
}),
|
|
// BullMQ job queue configuration
|
|
BullModule.forRoot({
|
|
connection: {
|
|
host: process.env.VALKEY_HOST ?? "localhost",
|
|
port: parseInt(process.env.VALKEY_PORT ?? "6379", 10),
|
|
},
|
|
}),
|
|
TelemetryModule,
|
|
PrismaModule,
|
|
DatabaseModule,
|
|
ValkeyModule,
|
|
BullMqModule,
|
|
StitcherModule,
|
|
AuthModule,
|
|
ActivityModule,
|
|
TasksModule,
|
|
EventsModule,
|
|
ProjectsModule,
|
|
DomainsModule,
|
|
IdeasModule,
|
|
WidgetsModule,
|
|
LayoutsModule,
|
|
KnowledgeModule,
|
|
UsersModule,
|
|
WebSocketModule,
|
|
LlmModule,
|
|
LlmUsageModule,
|
|
BrainModule,
|
|
CronModule,
|
|
AgentTasksModule,
|
|
RunnerJobsModule,
|
|
JobEventsModule,
|
|
JobStepsModule,
|
|
CoordinatorIntegrationModule,
|
|
FederationModule,
|
|
],
|
|
controllers: [AppController, CsrfController],
|
|
providers: [
|
|
AppService,
|
|
CsrfService,
|
|
{
|
|
provide: APP_INTERCEPTOR,
|
|
useClass: TelemetryInterceptor,
|
|
},
|
|
{
|
|
provide: APP_GUARD,
|
|
useClass: ThrottlerApiKeyGuard,
|
|
},
|
|
{
|
|
provide: APP_GUARD,
|
|
useClass: CsrfGuard,
|
|
},
|
|
],
|
|
})
|
|
export class AppModule {}
|