feat: comprehensive security hardening for Nova#367

Open

Taure wants to merge 12 commits into

feat/session-cookie-hardening

Commits on Mar 24, 2026

fix: harden session cookie security attributes

Taure
and
claude
committed
feat: add nova_secure_headers_plugin for HTTP security headers

Taure
and
claude
committed
feat: add nova_rate_limit_plugin for DoS/brute-force protection

Taure
and
claude
committed
feat: add session lifecycle management (timeout, rotation, cleanup)

Taure
and
claude
committed
fix: tighten CORS plugin defaults from wildcard to explicit values

Taure
and
claude
committed
feat: add nova_force_ssl_plugin for HTTP to HTTPS redirect

Taure
and
claude
committed
feat: add nova_log_filter for sensitive parameter redaction

Taure
and
claude
committed
fix: remove |safe filter from error template to prevent XSS

Taure
and
claude
committed
fix: prevent path traversal in nova_file_controller

Taure
and
claude
committed
chore: add erl_crash.dump to .gitignore

Taure
and
claude
committed
docs: add comprehensive security guide

Taure
and
claude
committed
fix: warn when session backend lacks rotate_session/2
Taure
committed