Implements multiple layers of security to address high-risk session
and authentication vulnerabilities identified in the security review:
- Allow code compilation (C, Python, Arduino) for anonymous users.
- Enforce a 1-request-per-2-minutes rate limit for anonymous IPs.
- Implement a global anonymous compilation queue with 20 concurrent slots.
- Proxy Velxio (Arduino) compilation through Flask to prevent API hijacking.
- Exempt authenticated users (tokens/cookies) from all rate limits.
- Fix networking and DNS resolution in podman-compose.
- Fix Svelte a11y warnings and trailing slash routing issues.
- Cookie Security: Added dynamic 'secure' flag support via COOKIE_SECURE
env variable for HTTPS/Tailscale Funnel compatibility.
- Rate Limiting: Integrated Flask-Limiter on /login (50 req/min) to
prevent API abuse while accommodating shared school networks (NAT).
- Tarpitting: Added 1.5s artificial delay on failed logins to neutralize
automated brute-force tools without blocking legitimate users.
- Session Invalidation: Implemented an in-memory token blacklist on
logout to ensure session tokens cannot be reused.
- Documentation: Updated technical docs and proposal status to reflect
the current security architecture.
Ref: @elemes/proposal.md (Poin 6.1, 6.2, 6.3)
- Menambahkan service 'compiler-worker' terpisah untuk isolasi eksekusi kode C/Python.
- Mengintegrasikan gVisor (runsc) pada worker untuk mencegah RCE pada level kernel.
- Menggunakan Gunicorn (4 workers) pada compiler-worker untuk mendukung concurrency.
- Menambahkan otentikasi token wajib pada endpoint /compile dan laporan progres.
- Memperketat CORS policy menggunakan environment variable ORIGIN.
- Menerapkan secure_filename pada rute pelajaran untuk mencegah Path Traversal.
- Mengubah volume mounting backend utama menjadi Read-Only (:ro) untuk perlindungan data.
- Memperbarui proposal.md dan .env.example dengan standar keamanan terbaru.
- Create student tutorial documentation in Markdown with updated asset paths
- Add backend routes to serve rendered help content and assets via JSON API
- Implement frontend /help route using SvelteKit for professional rendering
- Add "Bantuan" link to the navigation bar with custom styling
- Generate tutorial screenshots and a demo video with virtual cursor and subtitles
- Configure Tailscale and Vite proxies to support the new help routing
- Add automated video generation scripts and assets
- Added CircuitJSApi interface for simulator API interaction.
- Updated lesson page to support circuit simulation alongside code execution.
- Implemented separate output states for code and circuit evaluations.
- Enhanced lesson content rendering to include circuit embeds using markdown.
- Refactored backend to process circuit embed syntax and convert to HTML.
- Updated podman-compose configuration to include new environment variable for cursor offset.
- Created a proposal document outlining the feasibility and implementation plan for CircuitJS1 integration.
- Added proxy handling for `/assets/` in `sinau-c-tail.json` to route requests to the asset server.
- Enhanced `hooks.server.ts` to support proxying for both `/api/*` and `/assets/*` endpoints, including handling binary content.
- Introduced an anti copy-paste system in the lesson page to prevent text selection and copying from lesson content.
- Updated `CodeEditor.svelte` to prevent pasting from external sources with multiple layers of protection.
- Improved lesson page structure to support floating editor functionality and mobile responsiveness.
- Added celebration overlay for successful code completion in the lesson page.
- Adjusted `vite.config.ts` to include asset proxy configuration.
- Modified `podman-compose.yml` for production deployment with gunicorn and updated network settings.
- Add comprehensive LOAD_TESTING_GUIDE.md with instructions for different testing scenarios
- Implement advanced user behavior patterns in locustfile.py:
* SessionBasedUser class to simulate complete learning sessions
* BehaviorAnalysisTaskSet for sequential lesson progression
* PowerUser class representing intensive usage patterns
- Improve code extraction and compilation functionality to work with lesson content
- Enhance realism by using actual tokens from tokens_siswa.csv for user simulation
- Add proper progress tracking during simulated learning sessions
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
a2nr