c30faf02ef
1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org 2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP) 3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check 4. Login: constant-time bcrypt on user enumeration (dummy hash) 5. TgUsername saved in users (was lost) 6. User.IsVerified=true for Telegram users 7. Register: 409 instead of 500 on duplicate email 8. Bumped version to 0.4.0
16 lines
374 B
Modula-2
16 lines
374 B
Modula-2
module github.com/buhapp/backend
|
|
|
|
go 1.22
|
|
|
|
require (
|
|
github.com/gofiber/fiber/v2 v2.52.5
|
|
github.com/gofiber/contrib/websocket v1.3.0
|
|
github.com/golang-jwt/jwt/v5 v5.2.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/jackc/pgx/v5 v5.7.1
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/minio/minio-go/v7 v7.0.77
|
|
github.com/redis/go-redis/v9 v9.7.0
|
|
golang.org/x/crypto v0.27.0
|
|
)
|