Application Security Features

Relevant source files

The following files were used as context for generating this wiki page:

• PLAN.md
• src/server.js
• src/views.js
• test/app.test.js
• README.md
• src/widgets.js
• test/editor.browser.test.js

PuppyPad implements a multi-layered security architecture to protect the platform and its members. Because the service allows members to host custom HTML and JavaScript on subdomains, the system uses isolation, content scanning, and strict access controls to prevent cross-site contamination and abuse.

The security model focuses on three primary areas: protecting the main application from unauthorized access, isolating member sites from each other, and automatically detecting malicious content like phishing or crypto-miners.

Authentication and Access Control

PuppyPad secures account access using scrypt-hashed passwords and multi-factor authentication. Session management utilizes host-only cookies to prevent member subdomains from interfering with or stealing session identifiers.

Session Management

The application uses the __Host-sid cookie prefix when the connection is secure. This browser-level protection prevents subdomains from reading or overwriting the session cookie of the main domain.

Multi-Factor Authentication (MFA)

Members can enable Time-based One-Time Password (TOTP) authentication. The system provides 10 recovery codes upon setup for emergency access.

Feature	Implementation	Source
Algorithm	RFC 6238 TOTP	[test/app.test.js:629-635]
Secret Storage	Base32 Encoded String	[src/server.js:847-850]
Recovery Codes	SHA-256 hashed 10-character codes	[src/server.js:862-864]
Access	Required for login and 2FA deactivation	[src/server.js:731-740]

Content Security and Isolation

Member content is isolated to prevent cross-site scripting (XSS) and unauthorized file access.

Content Security Policy (CSP)

The main application serves a strict Content Security Policy. This policy allows scripts from the origin and Cloudflare (for Turnstile) while prohibiting object-src and base-uri overrides. Member sites do not receive a CSP, allowing them to run custom scripts in an isolated subdomain context.

const csp = (nonce) => [
  "default-src 'self'",
  `script-src 'self' 'nonce-${nonce}' https://challenges.cloudflare.com`,
  "style-src 'self' 'unsafe-inline'",
  "img-src 'self' data:",
  "frame-src https://challenges.cloudflare.com",
  "connect-src 'self'",
  "object-src 'none'",
  "base-uri 'self'",
  "form-action 'self'",
  "frame-ancestors 'none'",
].join('; ');

Sources: [src/server.js:358-370], [test/app.test.js:523-535]

File System Isolation

The application normalizes all file paths and validates them against the member's root directory. The resolveIn function prevents path traversal attacks by ensuring the resolved path starts with the member's specific site directory.

Method	Protection Provided	Source
safeRel	Strips .. and hidden files	[src/server.js:555-558]
resolveIn	Validates path is within member root	[src/server.js:189-193]
nosniff	Prevents MIME type sniffing	[src/server.js:199-200]
Sandboxed Preview	Editor uses sandbox="allow-scripts"	[src/views.js:255]

Abuse Prevention and Automated Defense

Automated systems monitor the platform for common attack vectors and malicious content.

Automated Phishing Detection

The autoFlag system scans saved or uploaded HTML, JS, and SVG files. It identifies "signals" such as password fields, credit card inputs, or specific brand names in the <title> tag.

Rate Limiting and Honeypots

The application enforces in-memory rate limits on sensitive endpoints and uses honeypot fields to identify automated bots.

• Rate Limits: Enforced on login (20 per 15 min), signup (5 per hour), and reports (5 per hour). [src/server.js:699-701], [src/server.js:636-638]
• Honeypots: Hidden website fields exist in signup, guestbook, and report forms. If a field contains data, the request is silently ignored or treated as a success without processing. [src/server.js:639-640], [src/server.js:283-284]

Administrative Security

Administrative privileges are restricted to specific confirmed email addresses rather than site names to prevent account squatting.

• Admin Identification: ADMIN_EMAILS are defined in the environment. [src/server.js:34]
• Admin Verification: A user only gains administrative rights if their email matches the list and is verified via an email link. [PLAN.md:78-83]
• Audit Logging: Every administrative action (ban, restore, delete, report closure) is recorded in the admin_log table with the moderator's username and action details. [src/server.js:1024-1025]

Conclusion

Security in PuppyPad relies on browser-level isolation via subdomains and host-only cookies, combined with server-side path validation and automated content flagging. These features allow the platform to host member-provided JavaScript while protecting the administrative core and preventing individual member sites from affecting the broader user base. Significance is placed on automated "fail-closed" mechanisms, such as Turnstile verification, to ensure platform stability against bot-driven abuse.

Sources: [PLAN.md:46-56], [src/server.js:34-40], [README.md:92-100]