security: harden first preview boundaries

Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata. AI-Assistance: OpenAI Codex assisted implementation, testing, and security review. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-16 19:20:14 -04:00
parent df946d888e
commit a18f1dd22a
13 changed files with 181 additions and 12 deletions
@@ -12,6 +12,11 @@ and session identifiers, digest-only session storage, Argon2id passwords,
 constant-time comparisons, same-origin and CSRF primitives, fail-closed storage
 errors, and separate safe/sensitive analytics projections.

+Unsafe methods without an exact Origin or trustworthy same-origin Fetch
+Metadata fail the origin check. Authentication middleware fails closed when its
+service or `__Host-` cookie policy is invalid. Imported request records have
+bounded byte and duration fields before analytics sums them.
+
 The toolkit does not sandbox application handlers, secure an incorrectly
 configured reverse proxy, authorize application routes automatically, encrypt a
 compromised host, or decide how long an operator may lawfully retain personal