mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-11-09 11:10:08 +01:00
Pontoporeia
554fc57455
The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.
Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
1. $_SERVER['HTTPS'] (direct TLS)
2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
client cannot spoof it
3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).
nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).
AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.
Tests (+24, 340 total):
- RequestUtilTest: scheme detection incl. proxy trust boundaries
- SessionCookieTest: logout emits a hardened deletion cookie
- PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
and is unaffected by scheme changes (Guzzle MockHandler)
- NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
server_tokens off
PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.
Nginx Configuration - XAMXAM
This directory contains nginx configuration and documentation for the XAMXAM TFE website.
📁 Files
xamxam.conf- Complete nginx configuration filedocs/- DocumentationPRODUCTION_DEPLOYMENT.md- Deployment guideQUICK_REFERENCE.md- Command referenceSECURITY_HEADERS.md- Security headers referencePHP_AUTH_LAYER.md- Authentication layer documentationHTACCESS_TO_NGINX.md- Apache to nginx migration notesTEST_DATABASE_SETUP.md- Test database deployment
🚀 Quick Start
Deploy nginx configuration
# From your local machine — this uploads nginx/xamxam.conf + scripts/deploy-server.sh,
# runs the script as root, then cleans up the remote temp files. No server-side step needed.
just deploy-nginx
The deployment script (scripts/deploy-server.sh) will:
- ✅ Fix file permissions (www-data:xamxam)
- ✅ Install nginx configuration
- ✅ Test and reload nginx
- ✅ Reload php-fpm (session-GC tuning) and verify it is running
Manage admin password
The admin password is managed via the admin panel at /admin/parametres → Account tab.
🔒 Security Features
Admin Panel Protection
- Password required for
/admin/(password-only, no username) - PHP session-based authentication (
AdminAuth) - Rate limited: 300 req/min, burst=30
File Access Protection
- Database files (
.db) - BLOCKED - Sensitive files (
.md,.sql,.env) - BLOCKED /srcdirectory - BLOCKED/templatesdirectory - BLOCKED/configdirectory - BLOCKED/storagedirectory - BLOCKED- Hidden files (
.git, etc.) - BLOCKED
Rate Limiting
- General requests: 30/minute
- Search endpoint: 30/minute
- Admin panel: 300 req/min (burst=30)
Security Headers
- ✅ X-Frame-Options (clickjacking protection)
- ✅ X-Content-Type-Options (MIME sniffing protection)
- ✅ Strict-Transport-Security (force HTTPS)
- ✅ Referrer-Policy (referrer control)
- ✅ Permissions-Policy (disable browser features)
📚 Documentation
- docs/PRODUCTION_DEPLOYMENT.md - Complete deployment guide
- docs/QUICK_REFERENCE.md - Command reference and troubleshooting
- docs/SECURITY_HEADERS.md - Security headers reference
🧪 Testing
# Test admin authentication
curl -I https://xamxam.erg.be/admin/
# Test file protection
curl -I https://xamxam.erg.be/storage/test.db
# Test security headers
curl -I https://xamxam.erg.be/ | grep -E "X-|Strict-Transport"
🆘 Quick Help
502 Bad Gateway
sudo systemctl status php8.4-fpm
sudo systemctl restart php8.4-fpm
Configuration errors
sudo nginx -t
📊 Monitoring
# Watch logs
sudo tail -f /var/log/nginx/xamxam-nginx-access.log
sudo tail -f /var/log/nginx/xamxam-nginx-error.log
# Check nginx status
sudo systemctl status nginx