- Encrypt session cookies (add encryption_salt to endpoint) - X-Frame-Options: SAMEORIGIN → DENY (match CSP frame-ancestors 'none') - Remove unsafe-eval from CSP script-src - Apply security headers in all environments (not just prod) - Add GraphQL query complexity limit (max 500) via Absinthe.Plug - GraphQL introspection already blocked in prod via plug Closes audit items #6, #7, #12, #13, #14, #16 |
||
|---|---|---|
| .. | ||
| integration | ||
| mix/tasks | ||
| snmpkit | ||
| support | ||
| towerops | ||
| towerops_web | ||
| test_helper.exs | ||
| towerops_native_test.exs | ||