Add security improvements: refresh tokens, passkeys, CSP, audit logging, TOTP encryption

- Shorten access token to 30min with 7-day refresh token flow
- Add WebAuthn passkey registration and login with TOTP fallback
- Add Content-Security-Policy header
- Add audit logging middleware to /volume1/docker/nas-dashboard/audit.log
- Block /volume1/docker/ in files endpoint
- Encrypt TOTP secret at rest with Fernet (derived from SECRET_KEY)
- New deps: py_webauthn, cryptography

This commit is contained in:

Gan, Jimmy

2026-02-22 10:54:23 +08:00

parent a10cb50ca0

commit be1f3b3ad6

10 changed files with 484 additions and 46 deletions

dashboard/backend/requirements.txt

View File

@@ -9,3 +9,5 @@ passlib==1.7.4
 pyotp==2.9.0
 asyncssh==2.17.0
 slowapi==0.1.9
 webauthn==2.7.1
 cryptography>=44.0.2