Security Considerations
On this page
Input Validation & Sanitization
- Markdown Content: Parsed and sanitized
- File Uploads: Type and size validation
- User Input: XSS prevention
- SQL Injection: N/A (file-based storage)
Access Control
- Authentication: Required for all admin operations
- Authorization: Role-based permissions
- CSRF Protection: Signed cookies and tokens
- Rate Limiting: Prevent brute force attacks
Security Headers
// Security middleware
'X-Frame-Options': 'DENY'
'X-Content-Type-Options': 'nosniff'
'X-XSS-Protection': '1; mode=block'
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
File System Security
- Path Traversal Prevention: Normalize and validate paths
- File Type Restrictions: Whitelist allowed extensions
- Metadata Isolation: Separate .metadata.json files