Security

Admin → Security (overview score), Headers, and Advanced. APIs: GET/PUT /api/security/headers, reset, POST /api/security/audit (grades a draft). Config is cached briefly (security-headers:config).

Managed headers#

Thirteen headers, each scoped to all / public / admin: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP, X-Permitted-Cross-Domain-Policies, X-DNS-Prefetch-Control, Origin-Agent-Cluster, X-XSS-Protection. Advanced adds custom headers, removing Server, and JSON export. Plugins can still adjust via http.responseHeaders.

Request hardening#

• CSRF — double-submit cookie jf_csrf + header x-csrf-token on mutating /api/* except login and install. Tokens rotate with token_version.
• Sessions — jf_session, HMAC-SHA256, 14 days. Password change, reset, 2FA changes, and logout bump token_version and reject old cookies.
• Passwords — PBKDF2-SHA256, 310k iterations, minimum 12 characters.
• 2FA — optional TOTP with encrypted recovery codes. See Users and roles.
• Login rate limit — 20/IP and 10/email per 15 minutes; exhausted windows lengthen up to 8× and send Retry-After.
• Express — default x-powered-by off; Justflows sets X-Powered-By: Justflows.
• Password reset — optional self-service reset by email: single-use SHA-256-hashed tokens, identical responses whether or not the address exists, and per-address and per-IP rate limits. See Users and roles.
• Correlation IDs — every HTTP response carries one, and sanitized errors are retained in a bounded buffer for Diagnostics.

Multisite and outbound hardening

• User management stays within your own access. Someone who manages users can assign roles, permissions, and scopes only within what they hold, and cannot change or remove an administrator. API keys are limited to their owner's permissions and scope.
• Outbound requests check the address they connect to. Webhooks, AI providers, and downloads refuse private addresses in every IPv6 form at connection time, and webhook responses are read only up to a small limit.
• Uploads are bounded. Each site has a limit on uploads in progress, oversized uploads are refused before and while they are read, and image processing runs a few at a time.
• Sites stay separate. A site that cannot be looked up gets a temporary error instead of another site's content, plugin routes answer only on sites where the plugin is on, and a sign-in only counts on the site it was made for.
• Packages must be pinned or Marketplace-signed. A signature carried inside a package's own manifest is not trusted.

Admin Content Security Policy#

The public site already enforces CSP by default. The admin now has its own enforcing policy as well, graded from the Security screen, because an admin session can install extensions and replace the core. Pre-session pages served by root server.js (/login, /install) also send security headers.

Admin URL#

Admin → Security → Admin URL moves the administration entry path off /admin. Reserved paths are rejected, a reachability check with automatic rollback runs before the change sticks, and the old path's behaviour (404 or redirect) is configurable. Sign-in and registration return a redirectTo that follows the configured path. Each site keeps its own admin path. The redirect from a renamed admin address back to the login page is not cached. JF_ADMIN_PATH_RECOVERY is the environment override for proxy or cache recovery, and its instructions show only on the platform site.

Audit log#

Admin → Security → Audit log reads the audit_log table (migrations 0008 / 0009). It records sign-ins and failed sign-ins, password changes and resets, 2FA enrolment, account creation, role changes and deletions, plugin/theme/CSS-provider installs and activations, core updates, security-header changes, and public-API toggles. Later releases also record custom-role and per-user access-policy changes, trash / restore / purge, password-reset requests and completions, admin-URL changes, and automatic-update runs. Every change an AI agent or the admin assistant makes is recorded as ai.tool_called (never the arguments), and saving or removing an AI provider key as ai.provider_saved / ai.provider_removed. Writes never throw into the action they describe. Retention defaults to 365 days (JF_AUDIT_RETENTION_DAYS).

Packages and updates#

Package authenticity is required by default. A .jfpkg needs a valid Marketplace signature or a digest in JUSTFLOWS_TRUSTED_PACKAGE_DIGESTS; JUSTFLOWS_ALLOW_UNSIGNED_PACKAGES=1 is the explicit legacy escape hatch. Core update digest pinning and HMAC signing are also available — see Configuration. Safe, size-limited zip extraction lives in @justflows/installer and rejects symlinks.