From 8538dc5b669edb8f19e598ee54801ebe56d3b5c2 Mon Sep 17 00:00:00 2001 From: TheFlow Date: Sat, 11 Oct 2025 17:26:50 +1300 Subject: [PATCH] security: harden admin panel before production deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Critical Security Fixes: 1. Remove default credentials from login page (inst_012 compliance) 2. Create auth-check.js utility for client-side authentication 3. Add authentication redirects to all admin pages Authentication Protection: - All admin pages now check for valid JWT token on load - Redirect to login if unauthenticated or token expired - Token expiration validation (client-side check) - Role verification (admin/moderator required) - Periodic token validity checks (every 5 minutes) Files Protected: ✅ /admin/dashboard.html ✅ /admin/rule-manager.html ✅ /admin/project-manager.html ✅ /admin/claude-md-migrator.html ✅ /admin/blog-curation.html ✅ /admin/audit-analytics.html (login.html excluded - entry point) Authentication Flow: 1. User accesses admin page 2. auth-check.js runs immediately 3. Check localStorage for admin_token 4. Parse JWT to verify expiration and role 5. If invalid: redirect to /admin/login.html with reason 6. If valid: allow page to load normally API Security (already in place): - All /api/admin/* endpoints require JWT - authenticateToken middleware validates tokens - requireRole middleware enforces admin/moderator access Addresses security concerns: - inst_012: No internal/confidential data exposure - inst_013: No sensitive runtime data in public endpoints - inst_014: No API surface enumeration - inst_015: No internal documentation exposure Remaining Recommendations: - Change default admin password on production (MANUAL STEP) - Consider IP whitelist for /admin/* (optional) - Add rate limiting to /api/auth/login (future enhancement) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- public/admin/audit-analytics.html | 1 + public/admin/blog-curation.html | 1 + public/admin/claude-md-migrator.html | 1 + public/admin/dashboard.html | 1 + public/admin/login.html | 2 +- public/admin/project-manager.html | 1 + public/admin/rule-manager.html | 1 + public/js/admin/auth-check.js | 135 +++++++++++++++++++++++++++ 8 files changed, 142 insertions(+), 1 deletion(-) create mode 100644 public/js/admin/auth-check.js diff --git a/public/admin/audit-analytics.html b/public/admin/audit-analytics.html index 1e0de208..8df4f834 100644 --- a/public/admin/audit-analytics.html +++ b/public/admin/audit-analytics.html @@ -6,6 +6,7 @@ Audit Analytics | Tractatus Admin +