Termix-SSH / Termix-SSH/Support
[FEATURE] Security features for login - web-app
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 28
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Title
Auto-generated SSL, force HTTPS only, login timeout after some time unused, option to disable remember device, passkey, yubikey for first time login
Platform
Web-app
Is it related to an issue?
Very easy to login and keep the session on. Risk is high for someone to hijack the session. Also high risk of intercepting http from server to client or to reverse proxy. HTTPS should be mandatory.
The Solution
As this app is very good and can have access to critical info and resources, I think there could be more robust login security.
Examples:
- Auto-generated SSL and HTTPS only by default
- Login timeout after some unused time
- Option to disable remember device
- Passkey login
- First time login verification via Yubikey (or need yubikey for every login)
Additional Context
No response
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the web-app authentication and session-security entry points; the issue does not name specific files, tests, or an implementation boundary. The work is complete only when the selected security features are defined, implemented, and covered by tests, but the request currently combines several independent features without acceptance criteria.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100