paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
19 lines
664 B
JavaScript
19 lines
664 B
JavaScript
exports.up = function(knex) {
|
|
return knex.schema.createTable('login_attempts', table => {
|
|
table.increments('id').primary();
|
|
table.string('identifier').notNullable(); // username or email
|
|
table.string('ip_address', 45).notNullable(); // IPv4 or IPv6
|
|
table.text('user_agent');
|
|
table.timestamp('attempt_time').defaultTo(knex.fn.now());
|
|
table.boolean('success').defaultTo(false);
|
|
|
|
// Indexes for performance
|
|
table.index('identifier');
|
|
table.index('attempt_time');
|
|
table.index(['identifier', 'success', 'attempt_time']);
|
|
});
|
|
};
|
|
|
|
exports.down = function(knex) {
|
|
return knex.schema.dropTableIfExists('login_attempts');
|
|
}; |