866bc175fb
All checks were successful
Build and Test / build-and-test (push) Successful in 38s
1. Enforce the 12h session lifetime server-side in requireAuth (reject a session older than the TTL even if the sealed cookie is intact), so a leaked cookie value can't be replayed indefinitely. Shared sessionTTL const drives both the cookie MaxAge and the check. 2. Send X-Content-Type-Options: nosniff when serving user-uploaded receipt/attachment bytes, so the browser won't sniff past the declared (upload-time allowlisted) MIME type. Update SPEC §2 and §6 accordingly; tests cover stale-session rejection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| static | ||
| templates | ||
| ai.go | ||
| ai_test.go | ||
| export.go | ||
| manage.go | ||
| manage_test.go | ||
| middleware.go | ||
| orientation.go | ||
| orientation_test.go | ||
| scan.go | ||
| templates.go | ||
| upload.go | ||
| upload_test.go | ||
| views.go | ||
| views_test.go | ||
| web.go | ||
| web_test.go | ||