Tronax 4ec0e483aa feat(server): add security hardening for public hosting ... - Add CSP, frame and referrer headers for served static files - Enforce WebSocket origin check to prevent cross-site hijacking - Trust X-Forwarded-For only when the peer is from a private proxy network - Limit concurrent connections (500 total / 20 per IP) and rooms (300) - Add ALLOWED_ORIGINS env var for additional WebSocket origins - Document reverse proxy setup (NPM/NPMplus) in README - Add scripts/security-test.mjs to verify origin and limit behavior		2026-08-16 13:16:20 +02:00
..
server.mjs	feat(server): add security hardening for public hosting	2026-08-16 13:16:20 +02:00