Security

Admin → Security (overview score), Headers, and Advanced. APIs: GET/PUT /api/security/headers, reset, POST /api/security/audit (grades a draft). Config is cached briefly (security-headers:config).

Managed headers#

Thirteen headers, each scoped to all / public / admin: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP, X-Permitted-Cross-Domain-Policies, X-DNS-Prefetch-Control, Origin-Agent-Cluster, X-XSS-Protection. Advanced adds custom headers, removing Server, and JSON export. Plugins can still adjust via http.responseHeaders.

Request hardening#

• CSRF — double-submit cookie jf_csrf + header x-csrf-token on mutating /api/* except login and install. Tokens rotate with token_version.
• Sessions — jf_session, HMAC-SHA256, 14 days. Password change, reset, 2FA changes, and logout bump token_version and reject old cookies.
• Passwords — PBKDF2-SHA256, 310k iterations, minimum 12 characters.
• 2FA — optional TOTP with encrypted recovery codes. See Users and roles.
• Login rate limit — 20/IP and 10/email per 15 minutes; exhausted windows lengthen up to 8× and send Retry-After.
• Express — default x-powered-by off; Justflows sets X-Powered-By: Justflows.
• Password reset — optional self-service reset by email: single-use SHA-256-hashed tokens, identical responses whether or not the address exists, and per-address and per-IP rate limits. See Users and roles.
• Correlation IDs — every HTTP response carries one, and sanitized errors are retained in a bounded buffer for Diagnostics.

Admin Content Security Policy#

The public site already enforces CSP by default. The admin now has its own enforcing policy as well, graded from the Security screen, because an admin session can install extensions and replace the core. Pre-session pages served by root server.js (/login, /install) also send security headers.

Admin URL#

Admin → Security → Admin URL moves the administration entry path off /admin. Reserved paths are rejected, a reachability check with automatic rollback runs before the change sticks, and the old path's behaviour (404 or redirect) is configurable. Sign-in and registration return a redirectTo that follows the configured path. JF_ADMIN_PATH_RECOVERY is the environment override for proxy or cache recovery.

Audit log#

Admin → Security → Audit log reads the audit_log table (migrations 0008 / 0009). It records sign-ins and failed sign-ins, password changes and resets, 2FA enrolment, account creation, role changes and deletions, plugin/theme/CSS-provider installs and activations, core updates, security-header changes, and public-API toggles. Later releases also record custom-role and per-user access-policy changes, trash / restore / purge, password-reset requests and completions, admin-URL changes, and automatic-update runs. Writes never throw into the action they describe. Retention defaults to 365 days (JF_AUDIT_RETENTION_DAYS).

Packages and updates#

Package authenticity is required by default. A .jfpkg needs a valid Marketplace signature or a digest in JUSTFLOWS_TRUSTED_PACKAGE_DIGESTS; JUSTFLOWS_ALLOW_UNSIGNED_PACKAGES=1 is the explicit legacy escape hatch. Core update digest pinning and HMAC signing are also available — see Configuration. Safe, size-limited zip extraction lives in @justflows/installer and rejects symlinks.