fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/config/securitySettings.go

@@ -0,0 +1,39 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+)
+
+const (
+	EnvJWTSecret             = "JWT_SECRET"
+	MinJWTSecretBytes        = 32
+	EnvSmtpAllowInsecure     = "SMTP_ALLOW_INSECURE"
+	DefaultSmtpAllowInsecure = "false"
+)
+
+var ErrWeakJWTSecret = errors.New("JWT_SECRET is too weak")
+
+var placeholderJWTSecrets = map[string]bool{
+	"change-me-to-a-long-random-string":          true,
+	"replace-with-output-of-openssl-rand-hex-32": true,
+}
+
+func ValidateJWTSecret(secret string) error {
+	if placeholderJWTSecrets[secret] {
+		return fmt.Errorf("%w: it is still the example value; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret)
+	}
+	if len(secret) < MinJWTSecretBytes {
+		return fmt.Errorf("%w: it must be at least %d bytes long; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret, MinJWTSecretBytes)
+	}
+	return nil
+}
+
+func jwtSecretFromEnv() (string, error) {
+	secret := os.Getenv(EnvJWTSecret)
+	if err := ValidateJWTSecret(secret); err != nil {
+		return "", err
+	}
+	return secret, nil
+}

internal/infrastructure/config/settings.go

@@ -9,11 +9,12 @@ import (
 )
 
 type SmtpSettings struct {
-	Login    string
-	Sender   string
-	Password string
-	Host     string
-	Port     int
+	Login         string
+	Sender        string
+	Password      string
+	Host          string
+	Port          int
+	AllowInsecure bool
 }
 
 type AuthRateLimitSettings struct {
@@ -55,11 +56,21 @@ func (s Settings) IsProduction() bool {
 }
 
 func NewSettingsFromEnv() (Settings, error) {
+	jwtSecret, err := jwtSecretFromEnv()
+	if err != nil {
+		return Settings{}, err
+	}
+
 	smtpPort, err := intEnv("SMTP_PORT")
 	if err != nil {
 		return Settings{}, err
 	}
 
+	smtpAllowInsecure, err := boolEnv(EnvSmtpAllowInsecure, DefaultSmtpAllowInsecure)
+	if err != nil {
+		return Settings{}, err
+	}
+
 	authRateLimitMaxAttempts, err := intEnv("AUTH_RATE_LIMIT_MAX_ATTEMPTS")
 	if err != nil {
 		return Settings{}, err
@@ -100,18 +111,19 @@ func NewSettingsFromEnv() (Settings, error) {
 		CorsAllowedOrigins: parseSemicolonSeparatedList(os.Getenv("CORS_ALLOWED_ORIGINS")),
 		PublicURL:          os.Getenv("PUBLIC_URL"),
 		UploadDir:          os.Getenv("UPLOAD_DIR"),
-		JWTSecret:          os.Getenv("JWT_SECRET"),
+		JWTSecret:          jwtSecret,
 		DBFile:             os.Getenv("DB_FILE"),
 		Database:           database,
 		Storage:            storage,
 		DataDirPath:        os.Getenv("DATA_DIR"),
 		Port:               os.Getenv("PORT"),
 		Smtp: SmtpSettings{
-			Login:    os.Getenv("SMTP_LOGIN"),
-			Sender:   os.Getenv("SMTP_SENDER"),
-			Password: os.Getenv("SMTP_PASSWORD"),
-			Host:     os.Getenv("SMTP_HOST"),
-			Port:     smtpPort,
+			Login:         os.Getenv("SMTP_LOGIN"),
+			Sender:        os.Getenv("SMTP_SENDER"),
+			Password:      os.Getenv("SMTP_PASSWORD"),
+			Host:          os.Getenv("SMTP_HOST"),
+			Port:          smtpPort,
+			AllowInsecure: smtpAllowInsecure,
 		},
 		AuthRateLimit: AuthRateLimitSettings{
 			MaxAttempts: authRateLimitMaxAttempts,