duffyduck/dyndns-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

F-15/F-16/F-17 Security-Header & Logout

Browse Source 
- F-15 CSRF-Logout: /logout nur noch via POST mit CSRF-Token; Sidebar-Link
  ist jetzt ein POST-Formular. Schuetzt vor Cross-Site-Logout (SameSite=Lax
  greift bei Top-Level-GET nicht).
- F-16 SRI: Subresource-Integrity-Hashes (sha384) + crossorigin fuer alle
  CDN-Ressourcen (Bootstrap CSS/JS, Bootstrap-Icons).
- F-17: Permissions-Policy-Header (deaktiviert ungenutzte Browser-Features).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Stefan Hacker
2026-06-06 16:25:32 +02:00
parent eca887eadb
commit eccce7e539
5 changed files with 24 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/static/css/app.css
+1
View File
@@ -13,6 +13,7 @@ body { background: #f4f6f9; min-height: 100vh; }
background: var(--sidebar-hover); color: #fff;
}
#sidebar .nav-link i { width: 1.3em; }
#sidebar button.nav-link { background: none; border: 0; width: 100%; text-align: left; cursor: pointer; }
#sidebar hr { border-color: var(--sidebar-hover); }
.main-content { flex: 1; padding: 2rem; min-width: 0; }
.card { border: none; box-shadow: 0 1px 4px rgba(0,0,0,.08); }