feat: add security hardening with rate limiting and pentest prep (Closes #64) #108

2026-04-07T15:54:09+02:00

shahondin1624 commented

2026-04-07 15:54:09 +02:00

Summary

RateLimitMiddleware: Per-endpoint rate limits using NC distributed cache (search 60/min, export/report 10/min, import 5/min). HTTP 429 on exceeded.
InputSanitizer: Static utility for HTML stripping, date/email/int validation, typed array sanitization as defense-in-depth layer.
Middleware registration: Registered in Application.php for all controller actions.
Security checklist: Comprehensive documentation covering input validation audit of all 12 controllers, SQL injection prevention verification, XSS/CSRF analysis, permission matrix, encrypted data inventory, dependency audit commands, manual pentest checklist, and deployment hardening guide.

Closes #64

Test plan

Rate limiter returns 429 after exceeding limit on search endpoint
Rate limiter uses NC distributed cache (Redis/APCu)
InputSanitizer strips HTML tags
InputSanitizer validates date format (YYYY-MM-DD)
Security checklist document is complete and actionable

## Summary - **RateLimitMiddleware**: Per-endpoint rate limits using NC distributed cache (search 60/min, export/report 10/min, import 5/min). HTTP 429 on exceeded. - **InputSanitizer**: Static utility for HTML stripping, date/email/int validation, typed array sanitization as defense-in-depth layer. - **Middleware registration**: Registered in Application.php for all controller actions. - **Security checklist**: Comprehensive documentation covering input validation audit of all 12 controllers, SQL injection prevention verification, XSS/CSRF analysis, permission matrix, encrypted data inventory, dependency audit commands, manual pentest checklist, and deployment hardening guide. Closes #64 ## Test plan - [ ] Rate limiter returns 429 after exceeding limit on search endpoint - [ ] Rate limiter uses NC distributed cache (Redis/APCu) - [ ] InputSanitizer strips HTML tags - [ ] InputSanitizer validates date format (YYYY-MM-DD) - [ ] Security checklist document is complete and actionable

shahondin1624 added 1 commit 2026-04-07 15:54:09 +02:00

feat: add security hardening with rate limiting and pentest prep (Closes #64 ) 280dbc845e

- RateLimitMiddleware: endpoint-specific rate limits (search 60/min,
  export/report 10/min, import 5/min, default 120/min) using NC
  distributed cache. Returns HTTP 429 with German error message.
- InputSanitizer: static utility for HTML stripping, date format
  validation, email validation, integer sanitization, typed array
  sanitization for defense-in-depth.
- Registered middleware in Application.php boot sequence.
- Security checklist documentation covering: input validation audit
  (all 12 controllers reviewed), SQL injection prevention, XSS/CSRF,
  permission matrix, encrypted data inventory, dependency audit
  commands, manual pentest checklist, deployment hardening guide.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

shahondin1624 merged commit 524c8690ca into main

2026-04-07 15:54:14 +02:00

shahondin1624 deleted branch feature/issue-64-security-hardening-pentest-prep

2026-04-07 15:54:14 +02:00

shahondin1624 referenced this issue from a commit

2026-04-07 15:54:15 +02:00

feat: add security hardening with rate limiting and pentest prep (Closes #64) (#108)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: shahondin1624/Mitgliederverwaltung#108