anders 4f3113199b Security hardening ...

- JWT: validate signing algorithm (prevent alg confusion)
- Login: rate limiting (10 attempts per 5 min per IP)
- Request body: 10MB size limit (prevent DoS)
- WebSocket: require JWT auth (token query param or cookie)
- Daemon endpoints: require admin role (not just any user)
- io.LimitReader on all request body decoding

2026-05-26 22:51:33 +02:00

..

main.go

Security hardening

2026-05-26 22:51:33 +02:00