Download Latest Version v0.20.3 source code.zip (2.3 MB)
Email in envelope

Get an email when there's a new version of Solarch

Home / 0.2.9
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-04-26 851 Bytes
0
TspoonBase v0.2.9 - Auth Security Fixes source code.tar.gz 2026-04-26 1.1 MB
0
TspoonBase v0.2.9 - Auth Security Fixes source code.zip 2026-04-26 1.2 MB
0
Totals: 3 Items   2.4 MB 0

Security fixes for authentication vulnerabilities:

Fixed in v0.2.9

  • #4 Refresh Token Reuse (CWE-640): Tokens now revoked after each use
  • Added token revocation store (_tokenRevocations table)

  • Applied to endpoints for admins and users

  • #5 OAuth2 State Validation (CWE-346): Added CSRF protection

  • Server-side state storage (_oauth2States table)

  • State validated before code exchange

  • #6 Password Reset Token Reuse (CWE-640): Tokens invalidated after use

  • Added password reset token store (_passwordResetTokens table)
  • Applied to admin and collection password reset flows

Previous fixes in v0.2.8:

  • Rate limiting on auth endpoints
  • Configurable bcrypt rounds
  • JWT secret configuration
  • File upload validation
  • SQL injection prevention
  • OTP IP binding
  • HTTPS via helmet
  • Batch API rate limiting
Source: README.md, updated 2026-04-26