Edi Life OS v1.1: what a public security pass changed after launching on Hacker News

Описание и применение

Edi Life OS v1.1 устранил критические уязвимости, включая XSS, открытые редиректы, отсутствие CSRF‑защиты, слабую ограниченность входов, отсутствие заголовков безопасности и небезопасные cookie, улучшив доверие пользователей.

Задача

The initial release of Edi Life OS exposed multiple security weaknesses such as stored XSS, open redirects, missing CSRF protection, inadequate rate limiting, missing security headers, and insecure cookie handling behind reverse proxies.

Результат

Edi Life OS v1.1 addressed critical security gaps, improving trust for self‑hosted users and demonstrating a transparent, public audit process.

Рабочий процесс

• 1. Reviewed PHP backend and frontend JavaScript for security issues.
• 2. Logged findings in a public GitHub issue and prioritized them.
• 3. Escaped all user‑generated content rendered with innerHTML.
• 4. Restricted redirect parameter to real same‑origin paths.
• 5. Added CSRF token checks to all write endpoints, including the habit tracker API.
• 6. Implemented sign‑in rate limiting (5 failed attempts per 15 minutes per IP).
• 7. Added security headers (CSP, X‑Frame‑Options, Referrer‑Policy, X‑Content‑Type‑Options).
• 8. Introduced LIFEOS_TRUST_PROXY setting for secure cookies and IP‑based rate limiting behind reverse proxies.
• 9. Refactored MCP server to expose a single lifeos_query tool with a type parameter.
• 10. Added new features: multi‑currency display, landing page, CI tests, Docker health check, and light‑theme screenshots.

Доказательства

Stored XSS on the dashboard. Goal titles, categories, metrics and finance category names were rendered with innerHTML without escaping.

Источник

Open redirect after sign-in. The redirect parameter only had to start with / and not //, which browsers can be tricked around.

Источник

Sign-in rate limiting. After 5 failed attempts from one client in 15 minutes you get 429 with Retry-After, and the password isn't even checked.

Источник

Security headers. Content-Security-Policy, X-Frame-Options: SAMEORIGIN, Referrer-Policy and X-Content-Type-Options on every response.

Источник

HTTPS behind a reverse proxy. A new LIFEOS_TRUST_PROXY setting makes the session cookie Secure based on X-Forwarded-Proto and rate-limits by the real client IP.

Источник