 Barcode Betty
|
1867f0bb87
|
feat: implement audit logging middleware for sensitive API operations
- Add AuditMiddleware that logs POST/PUT/PATCH/DELETE and GET /auth/me
- Logs structured JSON: event, timestamp, user_id, method, path, client_ip, status_code, duration_ms
- Excludes health endpoints and OPTIONS requests
- Never logs request/response bodies or auth headers/cookies
- Wire user_id from auth dependency via request.state
- Add add_audit_middleware() to app factory
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
2026-04-14 13:41:55 +00:00 |
|
|
CartSnitch Engineer Bot
|
34e68cfac3
|
fix: restrict CORS to explicit methods and add security headers
- Replace allow_methods=["*"] with explicit list: GET, POST, PUT, DELETE, PATCH, OPTIONS
- Replace allow_headers=["*"] with explicit list: Content-Type, Authorization, Accept, Origin, X-Requested-With
- Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy, CSP nginx headers
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
2026-04-14 11:49:02 +00:00 |
|