Fix security, stability, and performance quick wins - #193
Open
Sparksx wants to merge 1 commit into
Open
Conversation
Security: - Pin JWT algorithm to HS256 in all verify calls (defense against alg confusion) - Rate-limit the /api/auth/refresh endpoint with authLimiter - Whitelist allowed keys in PUT /api/auth/settings (prevent prototype pollution) - Escape interpolated values in admin dashboard innerHTML (role classes, sprite URLs) Stability: - Wrap clan leave + ownership transfer in a single Prisma transaction - Make refund gold clawback atomic with purchase status update - Use keepalive: true for save-on-unload fetch so browsers don't cancel it Performance: - Use lightweight include for clan listing (skip full member equipment) - Add Cache-Control: public, max-age=3600 to monster templates and sprites endpoints Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEkog6b5fHokF9F6nqWmPU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive codebase audit covering security, performance, stability, and functionality. This PR implements the 9 highest-priority quick wins identified (high impact, low effort).
Security fixes
jwt.verify()calls now specify{ algorithms: ['HS256'] }to prevent algorithm confusion attacks (alg: none)authLimiter(5 req/min) toPOST /api/auth/refresh— previously only had the global 100 req/min limitPUT /api/auth/settingsnow only accepts known keys (theme,language,soundEnabled,musicEnabled,notifications), preventing prototype pollution and oversized data storagestyleattributesStability fixes
ownerIdpurchase.statusupdate and gold deduction into one transaction — previously a crash after marking "refunded" but before deducting gold let players keep bothfetch()withkeepalive: trueinstead ofapiFetch(), so the browser completes the request even as the page is discardedPerformance fixes
GET /api/clansnow uses a minimal include (equipment only for power calculation) instead of loading full member profiles, PvP stats, and timestamps for all members of 25 clansCache-Control: public, max-age=3600to monster templates and sprites endpoints (matching the existing equipment/player template headers)Test plan
npm test)npm run lint— 53 pre-existing warnings only)npm run build)Generated by Claude Code