a620906209/CFDivePlatform
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(auth): P0 認證安全強化 #21

Merged
a620906209 merged 1 commits from security/auth-p0-hardening into master 2026-06-01 17:58:25 +00:00
Conversation 0 Commits 1 Files Changed 22
+502 -10
a620906209 commented 2026-06-01 17:58:18 +00:00
Owner
Copy Link
Copy Source
  • Token 過期時間設為 7 天（sanctum.php expiration）
  • prune-expired 每日排程清除過期 token 記錄
  • Google OAuth redirect 改用 URL fragment（#token=）避免 token 出現在 server log
  • SocialAuthController env() 改 config() 修正 config:cache 下 redirect 失效問題
  • 登入端點加 rate limiting：member/provider throttle:5,1，admin throttle:3,1
  • axios/coachAxios 加 401 response interceptor，token 過期自動登出
  • 修正 migration SQLite 相容性（MODIFY COLUMN），Feature tests 從 7 通過恢復至 41
  • 新增 AuthRateLimitTest（5 tests）驗證各角色頻率限制行為

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

- Token 過期時間設為 7 天（sanctum.php expiration） - prune-expired 每日排程清除過期 token 記錄 - Google OAuth redirect 改用 URL fragment（#token=）避免 token 出現在 server log - SocialAuthController env() 改 config() 修正 config:cache 下 redirect 失效問題 - 登入端點加 rate limiting：member/provider throttle:5,1，admin throttle:3,1 - axios/coachAxios 加 401 response interceptor，token 過期自動登出 - 修正 migration SQLite 相容性（MODIFY COLUMN），Feature tests 從 7 通過恢復至 41 - 新增 AuthRateLimitTest（5 tests）驗證各角色頻率限制行為 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
a620906209 added 1 commit 2026-06-01 17:58:19 +00:00
security(auth): P0 認證安全強化 cb9c9a9385 
- Token 過期時間設為 7 天（sanctum.php expiration）
- prune-expired 每日排程清除過期 token 記錄
- Google OAuth redirect 改用 URL fragment（#token=）避免 token 出現在 server log
- SocialAuthController env() 改 config() 修正 config:cache 下 redirect 失效問題
- 登入端點加 rate limiting：member/provider throttle:5,1，admin throttle:3,1
- axios/coachAxios 加 401 response interceptor，token 過期自動登出
- 修正 migration SQLite 相容性（MODIFY COLUMN），Feature tests 從 7 通過恢復至 41
- 新增 AuthRateLimitTest（5 tests）驗證各角色頻率限制行為

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
a620906209 merged commit a94c2462b8 into master 2026-06-01 17:58:25 +00:00
a620906209 deleted branch security/auth-p0-hardening 2026-06-01 17:58:25 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
a620906209
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: a620906209/CFDivePlatform#21
Delete Branch "security/auth-p0-hardening"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?