FrankandClaude Sonnet 5
2913b8d2a2
The admin panel already checked CSRF tokens on destructive actions, but the player-facing raw HTML forms (create/join/leave/start session, toggle ready, lobby chat, feedback) had none - cookie SameSite=Lax blunts classic cross-site auto-submit attacks but isn't a substitute for real tokens. Adds matching csrf_token()/ isCsrfTokenValid() checks to all of them. Also adds login_throttling (5 attempts/15 min) to stop unlimited password guessing, and a per-user rate limiter (10/min) on the invite-code join endpoint, since invite codes are only 32-bit and had no protection against brute-forcing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
# see https://symfony.com/doc/current/reference/configuration/framework.html
|
|
framework:
|
|
secret: '%env(APP_SECRET)%'
|
|
|
|
default_locale: 'en'
|
|
translator:
|
|
default_path: '%kernel.project_dir%/translations'
|
|
fallbacks: ['en', 'nl']
|
|
|
|
# Note that the session will be started ONLY if you read or write from it.
|
|
session:
|
|
handler_id: null
|
|
cookie_secure: auto
|
|
cookie_samesite: lax
|
|
storage_factory_id: session.storage.factory.native
|
|
save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
|
|
|
|
rate_limiter:
|
|
invite_code_join:
|
|
policy: 'sliding_window'
|
|
limit: 10
|
|
interval: '1 minute'
|
|
|
|
when@prod:
|
|
framework:
|
|
session:
|
|
handler_id: null
|
|
cookie_secure: true
|
|
cookie_samesite: lax
|
|
storage_factory_id: session.storage.factory.native
|
|
save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
|
|
|
|
#esi: true
|
|
#fragments: true
|
|
|
|
when@test:
|
|
framework:
|
|
test: true
|
|
session:
|
|
storage_factory_id: session.storage.factory.mock_file
|