+
);
@@ -162,9 +162,39 @@ export function MapView() {
{loading && (
)}
diff --git a/components/PasswordGate.tsx b/components/PasswordGate.tsx
index 2066616..8c1ef9a 100644
--- a/components/PasswordGate.tsx
+++ b/components/PasswordGate.tsx
@@ -33,11 +33,11 @@ export default function PasswordGate({ slug, title }: PasswordGateProps) {
if (res.ok) {
window.location.reload();
} else {
- setError('Wrong password');
+ setError('Incorrect password. Please try again.');
setPassword('');
}
} catch {
- setError('Something went wrong');
+ setError('Unable to verify password. Please try again later.');
} finally {
setLoading(false);
}
diff --git a/lib/cache.ts b/lib/cache.ts
index 325ed44..9b8c3a1 100644
--- a/lib/cache.ts
+++ b/lib/cache.ts
@@ -21,12 +21,19 @@ class MemoryCache {
return null;
}
+ // LRU: Move accessed item to the back of the Map (newest)
+ this.store.delete(key);
+ this.store.set(key, entry);
+
return entry.data as T;
}
set
(key: string, data: T, ttlMs: number): void {
- // Evict oldest entries if at capacity
- if (this.store.size >= this.maxEntries) {
+ // If key exists, delete it first to ensure we push it to the back
+ if (this.store.has(key)) {
+ this.store.delete(key);
+ } else if (this.store.size >= this.maxEntries) {
+ // Evict oldest entry (first item) if at capacity
const firstKey = this.store.keys().next().value;
if (firstKey) this.store.delete(firstKey);
}
diff --git a/middleware.ts b/middleware.ts
index 106517e..1ac3523 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -28,6 +28,12 @@ export function middleware(request: NextRequest) {
});
response.headers.set('Content-Security-Policy', cspDirectives);
+ response.headers.set('X-DNS-Prefetch-Control', 'on');
+ response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+ response.headers.set('X-Frame-Options', 'SAMEORIGIN');
+ response.headers.set('X-Content-Type-Options', 'nosniff');
+ response.headers.set('Referrer-Policy', 'origin-when-cross-origin');
+ response.headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
return response;
}
diff --git a/scripts/pentest-ratelimit.sh b/scripts/pentest-ratelimit.sh
new file mode 100755
index 0000000..71aa285
--- /dev/null
+++ b/scripts/pentest-ratelimit.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+# Simple rate limit testing script for Immich-Folio
+# It fires 15 rapid POST requests to the /api/auth endpoint.
+
+ENDPOINT="http://localhost:3000/api/auth"
+PAYLOAD='{"slug": "test", "password": "wrong"}'
+
+echo "======================================"
+echo "🛡️ Starting Rate-Limit Pentest..."
+echo "Target: $ENDPOINT"
+echo "Expected behavior: First 10 requests should be 40x (e.g. 401/400), subsequent requests should be 429."
+echo "======================================"
+
+for i in {1..15}
+do
+ echo -n "Request #$i: "
+
+ # Fetch the HTTP status code
+ HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d "$PAYLOAD" $ENDPOINT)
+
+ if [ "$HTTP_STATUS" == "429" ]; then
+ echo "🚨 HTTP 429 (Too Many Requests) -> RATE LIMIT TRIGGERED!"
+ else
+ echo "🟢 HTTP $HTTP_STATUS -> Allowed"
+ fi
+
+ # Sleep a tiny bit to avoid completely saturating local resources, but fast enough to hit the 10 RPM limit
+ sleep 0.2
+done
+
+echo "======================================"
+echo "Pentest completed! ✨"