A security review before letting anyone in
Before letting other people store their collections on TCG Marquee, I went through the app looking for security problems. A few turned up, and all of them are fixed.
What was fixed
- Card images from outside addresses are now checked on the server before they're fetched, so the image feature can't be used to reach things it shouldn't.
- The sign-in page's "go back to where you were" link now only goes to pages on this site.
- Security headers tell browsers to use HTTPS, refuse to show the site inside other sites' frames, and not guess at file types.
- Limits on repeated attempts, like password guessing, now count each real visitor separately, instead of seeing everyone as one visitor behind the network's front door.
- Signing out can no longer be triggered by another website.
- Uploaded logos are checked for size before they're processed, so a trick image can't overwhelm the server.
I'm keeping the specifics of how the site is hosted to myself, which is its own small security measure. The short version: the review found real things, they're fixed, and security checks are now a routine part of every change.