feat(worker): proxy security hardening — 7-layer defense-in-depth stack#62

Open

wgordon17 wants to merge 12 commits intogordon-code:mainfrom

wgordon17:worktree-proxy-security-hardening

Commits on Apr 9, 2026

docs(deploy): add WAF rules, Workers Secrets, and local dev documentation
wgordon17
committed
feat(worker): add crypto module for sealed tokens and session signing
wgordon17
committed
feat(worker): adds session cookie infrastructure
wgordon17
committed
feat(worker): integrate security middleware into fetch handler
wgordon17
committed
feat(auth): adds Turnstile widget, seal helper, proxy utilities
wgordon17
committed
fix(worker): address security and QA review findings
wgordon17
committed
docs: add /api/proxy/seal endpoint to DEPLOY.md API table
wgordon17
committed
fix(worker): pass sessionId to handleProxySeal for SC-11 audit logging
wgordon17
committed
fix(worker): add rate limiter error handling and invalid purpose test
wgordon17
committed
fix(security): adds Turnstile domains to CSP, removes dead body.code path, adds rate limiter error test
wgordon17
committed
refactor(worker): removes dead code, uses SealError class
wgordon17
committed
fix(worker): addresses PR review findings — security, perf, tests, docs
wgordon17
committed