fix(watch-http): 加固配对流程抵御 LAN 暴力破解#1
Open
8676311081 wants to merge 1 commit into
Open
Conversation
- 4-digit → 6-digit pairing code (10k → 1M values) - Per-peer-IP failure ledger with rolling 5-min window - Rotate code after 3 failures from a peer - Block peer for 5 min after 10 failures (429) - Constant-time code comparison - Accumulating HTTP parser with Content-Length handling + 64 KiB cap (previously assumed one packet = one request, silently failing on TCP fragmentation or oversized bodies) - Response builder now constructs bytes explicitly, not via string interpolation of Content-Length Follow-up not in this PR: TLS + loopback/interface binding option. The endpoint still listens on all interfaces in plaintext — bearer tokens and SSE payloads remain sniffable on untrusted LANs until TLS lands. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
后续（不在本 PR）
Test plan
🤖 Generated with Claude Code