v1.6.1: Sicherheit – Rate Limiting, Default-PW via Env, AUTH_SECRET Pflicht, Bcrypt 12

2026-05-11 13:26:51 +02:00
parent 0ea960259c
commit 9bea0a11de
33 changed files with 991 additions and 13 deletions
@@ -39,7 +39,9 @@ export async function verifyCredentials(
  if (!beo) return null;

  if (!beo.pw) {
-    const valid = password === 'welzheim';
+    const defaultPw = process.env.DEFAULT_PASSWORD;
+    if (!defaultPw) throw new Error('DEFAULT_PASSWORD Umgebungsvariable ist nicht gesetzt!');
+    const valid = password === defaultPw;
    return { beo, valid };
  }

@@ -48,7 +50,7 @@ export async function verifyCredentials(
 }

 export async function hashPassword(password: string): Promise<string> {
-  return bcrypt.hash(password, 10);
+  return bcrypt.hash(password, 12);
 }

 export function getBeoDisplayName(beo: Beo): string {