HTTP_REMOTE_TRUSTED_IPS is never validated – headers are accepted from anywhere
When trusted header authentication is enabled, standard login doesn't work (returns no response)
The login form should not be accessible in this mode (show a message or redirect instead)
Approach:
Validate HTTP_REMOTE_TRUSTED_IPS – only accept trusted headers from configured IP ranges
Fix standard login when trusted header auth is enabled (proper error response or UI redirect)
Add rate limiting to auth endpoints
Review CORS configuration
Add security headers (helmet or equivalent)
Audit for common vulnerabilities (XSS, injection, CSRF)
## Feature: Improved Application Security
**FeatureRequest enum:** `SECURITY`
**Description:** Zvýšení zabezpečení aplikace
### Implementation Notes
Harden the application security across authentication, input validation, and network layers.
**Key files to modify:**
- `server/src/auth.ts` – Review and strengthen authentication logic
- `server/src/index.ts` – Add security middleware (rate limiting, CORS hardening, helmet headers)
**Known issues from TODO.md:**
- `HTTP_REMOTE_TRUSTED_IPS` is never validated – headers are accepted from anywhere
- When trusted header authentication is enabled, standard login doesn't work (returns no response)
- The login form should not be accessible in this mode (show a message or redirect instead)
**Approach:**
1. Validate `HTTP_REMOTE_TRUSTED_IPS` – only accept trusted headers from configured IP ranges
2. Fix standard login when trusted header auth is enabled (proper error response or UI redirect)
3. Add rate limiting to auth endpoints
4. Review CORS configuration
5. Add security headers (helmet or equivalent)
6. Audit for common vulnerabilities (XSS, injection, CSRF)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Feature: Improved Application Security
FeatureRequest enum:
SECURITYDescription: Zvýšení zabezpečení aplikace
Implementation Notes
Harden the application security across authentication, input validation, and network layers.
Key files to modify:
server/src/auth.ts– Review and strengthen authentication logicserver/src/index.ts– Add security middleware (rate limiting, CORS hardening, helmet headers)Known issues from TODO.md:
HTTP_REMOTE_TRUSTED_IPSis never validated – headers are accepted from anywhereApproach:
HTTP_REMOTE_TRUSTED_IPS– only accept trusted headers from configured IP ranges