Page MenuHomePhabricator
Create Task
Maniphest T26

安全性
Closed, ResolvedPublic
Actions

Description

  • SSL
  • Authentication
  • CSRF
  • DDoS-resistent
  • etc.

Revisions and Commits

R10 PollingCenter Web Server
R10:eb26a50ca13f do not let disabled user login and check permission in account API
R10:f7aaca81bf6d add "remember me" for login
R10:67c1d02b28c0 add password hash with bcrypt
R10:71403f5eaef5 using spring-security

Related Objects
Search...

StatusAssignedTask
 ResolvediongchunT21 伺服器端
 ResolvediongchunT26 安全性
 ResolvediongchunT29 禁止停用的帳號登入
 ResolvediongchunT30 權限控制

Event Timeline

iongchun claimed this task.Aug 31 2017, 8:23 AM
iongchun created this task.
iongchun added a parent task: T21: 伺服器端.
iongchun added a commit: R10:71403f5eaef5: using spring-security.Sep 1 2017, 10:36 AM

Authentication and CSRF is implemented with spring-security

Other issues:

  • Password hash
  • SSL and certificate
iongchun triaged this task as High priority.Sep 1 2017, 10:38 AM
iongchun added a comment.Sep 2 2017, 9:09 PM

SSL deployed with certificate from Let's Encrypt

iongchun added a commit: R10:eb26a50ca13f: do not let disabled user login and check permission in account API.Sep 5 2017, 8:44 PM
  • Disabled user could not login now
  • User would be logout (session expired) immediately when being disabled
  • Add ROLE_ADMIN checking for Account REST API
iongchun closed this task as Resolved.Sep 19 2017, 4:22 PM