Plateforme centralisée de tryouts

Security Configuration

Required Environment Variables

Before deploying, create a .env file with the following:

# Flask Configuration (REQUIRED)
SECRET_KEY=your-secure-random-secret-key-here

# Production Settings
FLASK_DEBUG=false
FORCE_HTTPS=true
SESSION_COOKIE_SECURE=true

Security Features Implemented

• Rate Limiting: Login endpoint limited to 10 requests per minute to prevent brute-force attacks
• Secure Session Cookies: HTTPOnly, SameSite=Lax, and Secure flags enabled
• CSRF Protection: Enabled by default on all forms
• HTTPS Enforcement: Automatic redirect to HTTPS in production
• Security Headers: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, HSTS
• Open Redirect Prevention: URL validation on login redirect
• Authorization Checks: Proper ownership validation on all sensitive operations

Discord Integration for One on One Requests

The application supports sending Discord direct messages to coaches when players request One on One sessions.

Setup Instructions

1. Create a Discord Bot

1. Go to the Discord Developer Portal
2. Create a new application
3. Go to the "Bot" tab and create a bot user
4. Copy the bot token - this will be your DISCORD_BOT_TOKEN
5. Enable the "Message Content Intent" under Privileged Gateway Intents (required for sending messages)

2. Configure Environment Variables

Add the following to your .env file (create one if it doesn't exist):

DISCORD_BOT_TOKEN=your_bot_token_here
DISCORD_WEBHOOK_URL=optional_webhook_url_for_backup

• DISCORD_BOT_TOKEN: Required for sending direct messages to coaches
• DISCORD_WEBHOOK_URL: Optional fallback for webhook-based notifications

3. Add Coaches to the Bot

For the bot to send DMs to coaches:

1. Each coach must have the bot added to their Discord server OR be friends with the bot
2. Coaches need to add their Discord User ID to their profile:
   • Enable Developer Mode in Discord (User Settings → Advanced → Developer Mode)
   • Right-click on their profile → Copy ID
   • Enter this numeric ID in the "Discord User ID" field in their profile settings

How It Works

When a player submits a One on One request:

1. The system checks if the coach has a Discord User ID configured
2. If configured, a direct message is sent to the coach via the Discord bot
3. If the bot fails or no Discord User ID is set, the system falls back to the webhook URL (if configured)
4. The message includes player name, team, requested date/time, and discussion points

Message Format

The Discord DM includes:

• Player name
• Team name
• Requested date and time slot
• Discussion points (if provided)
• Link to the application for approval/rejection