 TradeMate Dev
|
c04fa2c19f
|
T-005: Security hardening - CORS, Rate Limit, CSRF
- CORS: Restrict allowed origins to specific frontend URLs, limit methods and headers
- Rate Limit: Add fine-grained endpoint-specific rate limits for sensitive operations
- Login: 5 requests/minute
- Register: 3 requests/hour
- Password change: 3 requests/5 minutes
- Payment: 20 requests/minute
- Admin: 30 requests/minute
- CSRF: Add CSRF protection middleware with double-submit cookie pattern
- New app/core/csrf.py module with CSRFMiddleware
- Require CSRF tokens on sensitive endpoints (auth, payment, profile)
- Skip webhook endpoints for CSRF validation
- Fix pydantic-settings import in config.py
|
2026-05-29 10:26:23 +08:00 |
|