JustFlows

Security

Security headers, CSRF, sessions, password hashing, rate limits, and signed packages.

8 min read

Admin → Security (overview score), Headers, and Advanced. APIs: GET/PUT /api/security/headers, reset, POST /api/security/audit (grades a draft). Config is cached briefly (security-headers:config).

Managed headers

Thirteen headers, each scoped to all / public / admin: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP, X-Permitted-Cross-Domain-Policies, X-DNS-Prefetch-Control, Origin-Agent-Cluster, X-XSS-Protection. Advanced adds custom headers, removing Server, and JSON export. Plugins can still adjust via http.responseHeaders.

Request hardening

  • CSRF — double-submit cookie jf_csrf + header x-csrf-token on mutating /api/* except login and install.
  • Sessions — jf_session, HMAC-SHA256, 14 days.
  • Passwords — PBKDF2-SHA256, 310k iterations.
  • Login rate limit — 20/IP and 10/email per 15 minutes.
  • Express — default x-powered-by off; Justflows sets X-Powered-By: Justflows.

Packages and updates

Optional JUSTFLOWS_REQUIRE_SIGNED_PACKAGES, trusted digests, update digest pin, and HMAC update signing — see Configuration. Safe zip extraction lives in @justflows/installer.