Kyle Isom
ec7c966ad2
- Trusted proxy config option for proxy-aware IP extraction used by rate limiting and audit logs; validates proxy IP before trusting X-Forwarded-For / X-Real-IP headers - TOTP replay protection via counter-based validation to reject reused codes within the same time step (±30s) - RateLimit middleware updated to extract client IP from proxy headers without IP spoofing risk - New tests for ClientIP proxy logic (spoofed headers, fallback) and extended rate-limit proxy coverage - HTMX error banner script integrated into web UI base - .gitignore updated for mciasdb build artifact Security: resolves CRIT-01 (TOTP replay attack) and DEF-03 (proxy-unaware rate limiting); gRPC TOTP enrollment aligned with REST via StorePendingTOTP Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
27 lines
1.1 KiB
JavaScript
27 lines
1.1 KiB
JavaScript
// mcias.js — HTMX event wiring for the MCIAS web UI.
|
|
|
|
// Show server error responses in the global #htmx-error-banner.
|
|
//
|
|
// HTMX 2.x fires htmx:responseError for 4xx/5xx responses and does not swap
|
|
// the body into the target by default. The server's renderError() always
|
|
// returns a <div class="alert alert-error"> fragment whose message is
|
|
// HTML-escaped server-side, so setting innerHTML here is safe.
|
|
document.body.addEventListener('htmx:responseError', function (evt) {
|
|
var banner = document.getElementById('htmx-error-banner');
|
|
if (!banner) { return; }
|
|
var body = (evt.detail.xhr && evt.detail.xhr.responseText) || 'An unexpected error occurred.';
|
|
banner.innerHTML = body;
|
|
banner.style.display = '';
|
|
banner.scrollIntoView({ behavior: 'instant', block: 'nearest' });
|
|
});
|
|
|
|
// Clear the error banner whenever a successful HTMX swap completes so
|
|
// stale errors do not persist after the user corrects their input.
|
|
document.body.addEventListener('htmx:afterSwap', function () {
|
|
var banner = document.getElementById('htmx-error-banner');
|
|
if (banner) {
|
|
banner.style.display = 'none';
|
|
banner.innerHTML = '';
|
|
}
|
|
});
|