Stefan Hacker
c3070469c1
- CSRF-Schutz: session-gebundenes Token in allen POST-Formularen, serverseitig per before_request geprueft; /nic/update ausgenommen (Basic-Auth-API) - Brute-Force-Schutz: DB-gestuetzter Login-Lockout pro Client-IP (5 Fehlversuche -> 15 min), echte IP via ProxyFix/X-Forwarded-For - SSRF: validate_plesk_url() erzwingt http(s) und blockt Link-Local/Metadata, Multicast und reservierte Ziele - Session-Cookies: HttpOnly, SameSite=Lax, Secure (per Env abschaltbar) - Security-Header: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy - Generische Plesk-Fehlermeldungen (keine internen URLs im UI) - CSS/JS nach static/ ausgelagert -> strikte CSP ohne 'unsafe-inline' - login_attempts-Tabelle + README-Security-Abschnitt Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.6 KiB
HTML
41 lines
1.6 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Login — DynDNS Manager</title>
|
|
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css">
|
|
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css">
|
|
<link rel="stylesheet" href="{{ url_for('static', filename='css/login.css') }}">
|
|
</head>
|
|
<body class="justify-content-center">
|
|
<div class="login-card">
|
|
<div class="text-center mb-4">
|
|
<span class="text-info fs-2"><i class="bi bi-globe2"></i></span>
|
|
<h4 class="text-white mt-2 mb-0">DynDNS Manager</h4>
|
|
</div>
|
|
<div class="card shadow">
|
|
<div class="card-body p-4">
|
|
{% with msgs = get_flashed_messages(with_categories=true) %}
|
|
{% for cat, msg in msgs %}
|
|
<div class="alert alert-{{ cat }} py-2">{{ msg }}</div>
|
|
{% endfor %}
|
|
{% endwith %}
|
|
<form method="post">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
|
|
<div class="mb-3">
|
|
<label class="form-label fw-semibold">Benutzername</label>
|
|
<input name="username" type="text" class="form-control" autofocus required>
|
|
</div>
|
|
<div class="mb-4">
|
|
<label class="form-label fw-semibold">Passwort</label>
|
|
<input name="password" type="password" class="form-control" required>
|
|
</div>
|
|
<button type="submit" class="btn btn-primary w-100">Anmelden</button>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>
|