ajouter des sécurité sur les URL, les Roles, les mdp

2026-07-20 14:57:12 -04:00
parent 482211e6e0
commit 87a84fd43b
20 changed files with 177 additions and 51 deletions
@@ -1,5 +1,31 @@
 ### Plateforme centralisée de tryouts

+## Security Configuration
+
+### Required Environment Variables
+
+Before deploying, create a `.env` file with the following:
+
+```
+# Flask Configuration (REQUIRED)
+SECRET_KEY=your-secure-random-secret-key-here
+
+# Production Settings
+FLASK_DEBUG=false
+FORCE_HTTPS=true
+SESSION_COOKIE_SECURE=true
+```
+
+### Security Features Implemented
+
+- **Rate Limiting**: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
+- **Secure Session Cookies**: HTTPOnly, SameSite=Lax, and Secure flags enabled
+- **CSRF Protection**: Enabled by default on all forms
+- **HTTPS Enforcement**: Automatic redirect to HTTPS in production
+- **Security Headers**: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
+- **Open Redirect Prevention**: URL validation on login redirect
+- **Authorization Checks**: Proper ownership validation on all sensitive operations
+
 ## Discord Integration for One on One Requests

 The application supports sending Discord direct messages to coaches when players request One on One sessions.