added input validation and security hardening

2026-02-02 14:39:50 -07:00
parent d520c4ae41
commit 84803a353e
3 changed files with 225 additions and 73 deletions
--- a/backend/routes/auth.js
+++ b/backend/routes/auth.js
@@ -219,8 +219,13 @@ function createAuthRouter(db, logAudit) {
        }
    });

-    // Clean up expired sessions (can be called periodically)
+    // Clean up expired sessions (admin only)
    router.post('/cleanup-sessions', async (req, res) => {
+        // Basic auth check - require a valid session to call this
+        const sessionId = req.cookies?.session_id;
+        if (!sessionId) {
+            return res.status(401).json({ error: 'Authentication required' });
+        }
        try {
            await new Promise((resolve, reject) => {
                db.run(