Module 16: Security: sessions, uploads, SSRF and XSS
24 min read·
About 45 minutes · Needs: Module 6 (sign-in, the session cookie and the brand), Module 7 (the deck spec and escaping on render), Module 11 (Chromium and its request allow list) · Code:backend/app/main.py,backend/app/core/ratelimit.py,backend/app/api/routes/auth.py,backend/app/core/config.py,backend/app/services/files.py,backend/app/render/chromium.py,backend/app/schemas/deck.py,frontend/src/render/text.ts,frontend/nginx.conf.template,backend/tests/test_security.py
Where this fits
Every other module adds a feature. This one asks how each feature can be abused, and shows the code that stops it. The highlighted parts are where attacks land: the front door (nginx and the session), the brand kit with its uploads, the projects that hold deck text, and the server's own Chromium, which opens pages on the server's network.