root 3618323192 fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流 ...

- P0/P1 审计修复: 滑块验证码不再下发 x_position/成败即销毁 key、
  user-login 补失败计数+滑块门控、限流标识改 X-Real-IP、
  百度翻译 appkey 环境化、ChangeEmail/ChangePhone 补调 avalidate、
  logs/tasks.py Count(filter=Q) 修复、chat 收藏 SSRF 内网黑名单
- P1 #6/7: token_blacklist + ROTATE_REFRESH_TOKENS 开启,
  /user/token/refresh/ 挂载
- #2 JWT HttpOnly Cookie 双模认证: user/cookie_auth.py 种/清 Cookie,
  user/authentication.py CookieOrHeaderJWTAuthentication(Bearer 优先/_COOKIE 兜底),
  user/views/token.py CookieTokenRefreshView + UserLogoutAPIView(/user/logout/),
  create_standardized_response 自动对含 token 的响应种 Cookie,
  异步视图内 RefreshToken.for_user 全部 sync_to_async 包裹(修 SynchronousOnlyOperation 500),
  WS ChatConsumer 优先读 Cookie token
- P2 #11 限流: utils/rate_limit.py 固定窗口频控,
  shorturl 生成 匿名10次/分+登录60次/分, 邮箱验证码 同邮箱60s1次+同IP10次/10min,
  登录/注册验证码 错5次作废+成功即销毁防重放, 换绑邮箱/手机 同步落地,
  urls.py 补挂 shorturl 路由(此前 404)

2026-09-08 11:28:00 +08:00

.claude

sync from local backup

2026-08-05 23:59:15 +08:00

.idea

sync from local backup

2026-08-05 23:59:15 +08:00

air_quality

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

api

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

apidirectory

feat: 100% async - native async serializers (adata/asave/acreate), async cache (redis.asyncio), view call-site migration

2026-09-06 14:36:41 +08:00

app

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

article

fix(pre-existing): FUser has no nickname field - use first_name (article notify, message sender_name, bug user_name)

2026-09-06 16:43:20 +08:00

bug

fix(pre-existing): FUser has no nickname field - use first_name (article notify, message sender_name, bug user_name)

2026-09-06 16:43:20 +08:00

chat

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

chunyu_project

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

currency

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

docs

docs: phase-3 deep regression results - 3 pre-existing bugs fixed, full auth-flow tests 17/17

2026-09-06 16:47:55 +08:00

history

feat: 100% async - native async serializers (adata/asave/acreate), async cache (redis.asyncio), view call-site migration

2026-09-06 14:36:41 +08:00

learn

refactor: last serializer.save fallbacks -> native asave (bug comment, learn chapter)

2026-09-06 14:50:01 +08:00

locale

sync from local backup

2026-08-05 23:59:15 +08:00

logs

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

media/learn/courses

sync from local backup

2026-08-05 23:59:15 +08:00

message

fix(pre-existing): FUser has no nickname field - use first_name (article notify, message sender_name, bug user_name)

2026-09-06 16:43:20 +08:00

search

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

shorturl

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

static

sync from local backup

2026-08-05 23:59:15 +08:00

templates

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

tool

feat: 100% async - native async serializers (adata/asave/acreate), async cache (redis.asyncio), view call-site migration

2026-09-06 14:36:41 +08:00

user

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

utils

fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

2026-09-08 11:28:00 +08:00

weather

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

_temp_set_code.py

sync from local backup

2026-08-05 23:59:15 +08:00

_temp_set_user.py

sync from local backup

2026-08-05 23:59:15 +08:00

_test_admin_smoke.py

sync from local backup

2026-08-05 23:59:15 +08:00

.dockerignore

fix: unreachable /api/apidirectory/ include (route order), add user & apidirectory index views, include static/ in docker image

2026-09-04 13:44:33 +08:00

.gitignore

sync from local backup

2026-08-05 23:59:15 +08:00

check_password.py

sync from local backup

2026-08-05 23:59:15 +08:00

check_users.py

sync from local backup

2026-08-05 23:59:15 +08:00

CHINESE_DOCUMENTATION_SUMMARY.md

sync from local backup

2026-08-05 23:59:15 +08:00

create_admin_user.py

sync from local backup

2026-08-05 23:59:15 +08:00

create_new_test_user.py

sync from local backup

2026-08-05 23:59:15 +08:00

create_test_user.py

sync from local backup

2026-08-05 23:59:15 +08:00

Dockerfile

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

DOCUMENTATION_SimplifiedChinese.md

sync from local backup

2026-08-05 23:59:15 +08:00

DOCUMENTATION.md

sync from local backup

2026-08-05 23:59:15 +08:00

FINAL_PROJECT_STATUS.md

sync from local backup

2026-08-05 23:59:15 +08:00

FINAL_VERIFICATION.md

sync from local backup

2026-08-05 23:59:15 +08:00

final_verify.py

sync from local backup

2026-08-05 23:59:15 +08:00

FULL_DOCUMENTATION_SUMMARY.md

sync from local backup

2026-08-05 23:59:15 +08:00

manage.py

sync from local backup

2026-08-05 23:59:15 +08:00

ONLY_CHINESE_DOCS.md

sync from local backup

2026-08-05 23:59:15 +08:00

requirements_install.txt

sync from local backup

2026-08-05 23:59:15 +08:00

requirements_local.txt

sync from local backup

2026-08-05 23:59:15 +08:00

requirements.txt

feat: ADRF async views (phase1) + native async serializers (phase2) + async cache infra

2026-09-06 14:26:17 +08:00

reset_test.py

sync from local backup

2026-08-05 23:59:15 +08:00

set_token.js

sync from local backup

2026-08-05 23:59:15 +08:00

set_user_password.py

sync from local backup

2026-08-05 23:59:15 +08:00

STATUS_REPORT.md

sync from local backup

2026-08-05 23:59:15 +08:00

test_all_apis.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_api_now.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_baidu_enums.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_fresh.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_full_flow.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_login_api.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_settings.py

sync from local backup

2026-08-05 23:59:15 +08:00

test_token.py

sync from local backup

2026-08-05 23:59:15 +08:00

verify_and_test.py

sync from local backup

2026-08-05 23:59:15 +08:00

verify_reset.py

sync from local backup

2026-08-05 23:59:15 +08:00

S

Description

No description provided

835 KiB

Languages

Python 94.6%

HTML 3.1%

JavaScript 1.3%

CSS 0.9%