You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
33 lines
1.2 KiB
33 lines
1.2 KiB
2 weeks ago
|
# Security Audit Checklist for Web Push Service
|
||
|
|
|
||
|
|
## Authentication & Authorization
|
||
|
|
- [x] Basic auth implemented for admin endpoints
|
||
|
|
- [x] VAPID authentication for push notifications
|
||
|
|
- [x] Environment variable for admin password
|
||
|
|
- [ ] Consider rate limiting for subscription endpoints
|
||
|
|
- [ ] Consider adding API key authentication for public endpoints
|
||
|
|
|
||
|
|
## Data Validation
|
||
|
|
- [x] Input validation for subscription data
|
||
|
|
- [x] Message size limits (100 chars)
|
||
|
|
- [x] Notification type validation
|
||
|
|
- [ ] Consider adding input sanitization for messages
|
||
|
|
|
||
|
|
## Database Security
|
||
|
|
- [x] SQLite database with configurable path
|
||
|
|
- [x] No raw SQL queries (uses SQLAlchemy ORM)
|
||
|
|
- [ ] Consider adding database connection pooling
|
||
|
|
- [ ] Consider encryption at rest for sensitive data
|
||
|
|
|
||
|
|
## Push Notification Security
|
||
|
|
- [x] VAPID key rotation capability
|
||
|
|
- [x] Secure key generation using cryptography library
|
||
|
|
- [x] Proper error handling for expired subscriptions
|
||
|
|
- [ ] Consider adding payload encryption
|
||
|
|
|
||
|
|
## General Security
|
||
|
|
- [x] Type hints for better code safety
|
||
|
|
- [x] Error logging implemented
|
||
|
|
- [ ] Consider adding request logging
|
||
|
|
- [ ] Consider adding CORS protection
|
||
|
|
- [ ] Consider adding CSP headers
|