Harwinder Sekhon
17a401c313
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with strict session-ID mode; the CSRF token from GET api/auth.php must now accompany every state-changing request (X-CSRF-Token header, or a csrf body field for the sendBeacon progress save), rotated at login. - Failed sign-ins are throttled per username and IP via login_attempts (created lazily, so existing installs need no migration): 5 failures a username / 20 an IP inside 15 minutes answer 429 with Retry-After. - A video's sibling .srt now appears as a CC button in the player; captions.php converts it to WebVTT (comma timestamps, legacy encodings, and the already-VTT files with out-of-spec 6-digit fractions). - Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and anime.js is gone along with all scripted animations and the motion setting — the app now runs with no internet access at all. - .htaccess denies direct access to videos/, includes/, config.php and schema.sql, so video URLs cannot bypass login on Apache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
16 lines
570 B
ApacheConf
16 lines
570 B
ApacheConf
# Apache: keep non-public files out of reach. Nginx setups need the
|
|
# equivalent location blocks (see README, Production notes).
|
|
|
|
Options -Indexes
|
|
|
|
# The video library is served only through stream.php (auth + Range); the
|
|
# quiz/caption sources only through their endpoints. Direct URLs would
|
|
# bypass login entirely.
|
|
RedirectMatch 404 ^/videos/
|
|
|
|
# App internals — nothing under these is meant to be fetched.
|
|
RedirectMatch 404 ^/includes/
|
|
<FilesMatch "^(config\.php|config\.example\.php|schema\.sql|\.install\.lock|\.gitignore)$">
|
|
Require all denied
|
|
</FilesMatch>
|