security: harden production defaults and shared throttling

Author: feskolech

.env.example

@@ -25,6 +25,16 @@ ADMIN_PASSWORD=admin123
 # Steam polling
 STEAM_POLL_INTERVAL_SEC=5
 
+# Shared rate limiting (optional outside Docker; Docker Compose defaults to redis://redis:6379/0)
+RATE_LIMIT_REDIS_URL=
+# Leave empty for the default prefix derived from NODE_ENV, or override per environment/shared Redis.
+RATE_LIMIT_REDIS_PREFIX=
+
+# Production transport security
+FORCE_HTTPS=true
+# OPENAPI_ENABLED defaults to true in dev/test and false in production.
+# Set to true only when you explicitly want to expose /api-docs/openapi.json.
+
 # Cloudflare Turnstile (optional anti-bot registration protection)
 TURNSTILE_ENABLED=false
 TURNSTILE_SITE_KEY=

.github/workflows/ci.yml

@@ -1,11 +1,22 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ['**']
   pull_request:
 
 jobs:
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+
   backend:
     runs-on: ubuntu-latest
     defaults:
@@ -18,10 +29,25 @@ jobs:
           node-version: 20
           cache: npm
           cache-dependency-path: backend/package-lock.json
-      - run: npm install
+      - run: npm ci
       - run: npm run lint
       - run: npm run test
 
+  backend-audit:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - run: npm ci
+      - run: npm audit --omit=dev --audit-level=high
+
   frontend:
     runs-on: ubuntu-latest
     defaults:
@@ -34,6 +60,21 @@ jobs:
           node-version: 20
           cache: npm
           cache-dependency-path: frontend/package-lock.json
-      - run: npm install
+      - run: npm ci
       - run: npm run lint
       - run: npm run test
+
+  frontend-audit:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - run: npm ci
+      - run: npm audit --omit=dev --audit-level=high

README.md

@@ -13,6 +13,7 @@ Open-source web implementation of Steam Desktop Authenticator (SDA) with multi-u
 - **Fastify (instead of Express)**: lower overhead and better throughput for polling/real-time workloads.
 - **TypeScript on backend/frontend**: safer refactoring and better API contracts.
 - **MySQL 8 + Docker internal network**: relational consistency, easy VPS deploy, DB isolated from public access.
+- **Redis-backed rate limiting in Docker**: shared throttling across backend instances and backend restarts, with in-memory fallback outside Redis setups.
 - **React + Vite + Tailwind**: fast DX + responsive UI + simple theming.
 - **Vite PWA plugin**: installable app + service worker caching.
 - **Aiogram bot**: mature async Telegram framework for command and deep-link flows.
@@ -33,7 +34,7 @@ Open-source web implementation of Steam Desktop Authenticator (SDA) with multi-u
 - Password re-confirmation for sensitive actions such as `.maFile` export, recovery code reveal and manual Steam session save.
 - i18n EN/RU + light/dark theme.
 - Admin panel with global registration toggle and user deletion.
-- OpenAPI docs JSON at `/api-docs/openapi.json`.
+- OpenAPI docs JSON at `/api-docs/openapi.json` when `OPENAPI_ENABLED=true`.
 
 ## Default admin
 
@@ -45,6 +46,7 @@ Open-source web implementation of Steam Desktop Authenticator (SDA) with multi-u
 Important:
 - The default admin password is for local bootstrap only.
 - Production startup is blocked if `ADMIN_PASSWORD=admin123`.
+- Production startup is also blocked if `JWT_SECRET`, `COOKIE_SECRET`, or `ENCRYPTION_KEY` still use placeholder-style values such as `change_me...`, are shorter than 32 characters, or reuse the same secret value.
 
 ## Architecture
 
@@ -81,7 +83,7 @@ make dev
 Open:
 - Frontend: `http://localhost:3000`
 - Backend API: `http://localhost:3001`
-- OpenAPI: `http://localhost:3001/api-docs/openapi.json`
+- OpenAPI: `http://localhost:3001/api-docs/openapi.json` (enabled by default in dev/test)
 
 ## Make targets
 
@@ -102,12 +104,32 @@ Core variables:
 - `DB_*` MySQL connection and bootstrap user credentials.
 - `JWT_SECRET`, `COOKIE_SECRET`, `ENCRYPTION_KEY` security secrets.
 - `APP_URL`, `API_URL` frontend/backend origins.
+- `RATE_LIMIT_REDIS_URL`, `RATE_LIMIT_REDIS_PREFIX` shared rate limiting backend; Docker Compose defaults to internal Redis and a NODE_ENV-based prefix.
+- `FORCE_HTTPS` enables HTTP->HTTPS redirects in production (`true` by default, can be disabled for special deployments).
+- `OPENAPI_ENABLED` controls `/api-docs/openapi.json`; enabled by default in dev/test and should stay off in production unless explicitly needed.
 - `TELEGRAM_BOT_TOKEN`, `TELEGRAM_BOT_USERNAME` bot settings.
 - `STEAM_POLL_INTERVAL_SEC` auto-confirm polling interval.
 - `TURNSTILE_ENABLED`, `TURNSTILE_SITE_KEY`, `TURNSTILE_SECRET_KEY` optional Cloudflare Turnstile backend protection.
 - `VITE_TURNSTILE_SITE_KEY` frontend public site key for invisible Turnstile registration flow. Use the same value as `TURNSTILE_SITE_KEY` because it is the same public Cloudflare site key, just exposed to the Vite frontend build via the `VITE_` prefix.
 
+Generate strong secrets before production deploy, for example:
+
+```bash
+openssl rand -hex 32
+openssl rand -hex 32
+openssl rand -hex 32
+```
+
+Then place the generated values into `.env` as:
+
+```env
+JWT_SECRET=<first generated value>
+COOKIE_SECRET=<second generated value>
+ENCRYPTION_KEY=<third generated value>
+```
+
 If `TELEGRAM_BOT_TOKEN` is empty or starts with `change_me`, bot service stays in disabled idle mode (no crash, API stays up).
+If you enable `OPENAPI_ENABLED` in production, prefer exposing it only behind admin auth, VPN, or IP allowlisting.
 
 ## Security model
 
@@ -117,9 +139,11 @@ If `TELEGRAM_BOT_TOKEN` is empty or starts with `change_me`, bot service stays i
 - **Sensitive actions**: password re-confirmation required before `.maFile` export, recovery code reveal and manual Steam session updates.
 - **CSRF**: double-submit protection for mutating endpoints.
 - **Brute-force/DoS**: `rate-limiter-flexible` in auth/write paths.
+- **Shared throttling**: Docker deployments use Redis-backed rate limits with in-memory insurance fallback if Redis is temporarily unavailable; current Compose defaults do not persist limiter state across Redis restarts.
 - **Anti-bot registration**: signed registration challenge, honeypot, dedicated registration rate limiter and optional invisible Cloudflare Turnstile.
 - **Hardening**: `helmet`, CORS with credentials.
 - **WebSocket auth**: cookie/bearer only, query-string auth disabled.
+- **API caching**: `/api/*` responses are served with `Cache-Control: no-store` to reduce leakage of session-bound data.
 - **DB isolation**: MySQL only on internal Docker network (`db_internal`).
 
 ## Telegram flows
@@ -135,6 +159,8 @@ If `TELEGRAM_BOT_TOKEN` is empty or starts with `change_me`, bot service stays i
 3. Bot confirms code.
 4. Web page polls and creates session automatically.
 
+Deploy frontend and backend together when changing Telegram login polling, because the flow now requires the `x-telegram-poll-token` header instead of the legacy query-string token.
+
 ## Steam confirmations notes
 
 Steam mobile confirmations require valid session tokens (`steamLoginSecure`, `sessionid`, optional `oauthToken`).

backend/package-lock.json

@@ -25,6 +25,7 @@
     "dotenv": "^16.4.5",
     "fastify": "^5.7.4",
     "fastify-plugin": "^5.1.0",
+    "ioredis": "^5.10.1",
     "jsonwebtoken": "^9.0.2",
     "mysql2": "^3.12.0",
     "pino-pretty": "^13.0.0",

backend/package.json

@@ -13,6 +13,7 @@ import botRoutes from './routes/bot';
 import notificationRoutes from './routes/notifications';
 import { wsHub } from './services/wsHub';
 import { getBearerToken, verifySessionToken } from './utils/jwt';
+import { isProd } from './config/env';
 
 function cookieValue(cookieHeader: string | undefined, name: string): string | null {
   if (!cookieHeader) {
@@ -33,6 +34,7 @@ function cookieValue(cookieHeader: string | undefined, name: string): string | n
 
 export async function buildApp() {
   const app = Fastify({
+    trustProxy: isProd ? 'loopback, linklocal, uniquelocal' : false,
     logger: {
       transport:
         process.env.NODE_ENV === 'development'