fix: harden CAPTCHA URL, raise rate limit, replace shell-expanded JWT secret

Author: ddrayko

config/cap.js

@@ -19,17 +19,26 @@ async function fetchWithTimeout(url, options = {}, timeout = 10000) {
   }
 }
 
+function normalizeUrl(base) {
+  return base.endsWith('/') ? base : base + '/';
+}
+
 export async function verifyCap(token) {
   if (!token) return false;
+  const url = `${normalizeUrl(CAP_ENDPOINT)}siteverify`;
   try {
-    const res = await fetchWithTimeout(`${CAP_ENDPOINT}siteverify`, {
+    const res = await fetchWithTimeout(url, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ secret: CAP_SECRET, response: token }),
     });
     const data = await res.json();
+    if (data.success !== true) {
+      console.error('[CAP] Verification failed:', JSON.stringify(data));
+    }
     return data.success === true;
-  } catch {
+  } catch (err) {
+    console.error('[CAP] Service unreachable at', url, ':', err.message);
     return false;
   }
 }

middleware/auth.js

@@ -4,6 +4,8 @@ const JWT_SECRET = process.env.JWT_SECRET;
 
 if (!JWT_SECRET) {
   console.error('Missing JWT_SECRET environment variable');
+} else if (/[\$\(\)]/.test(JWT_SECRET)) {
+  console.error('JWT_SECRET contains unresolved shell expansion characters ($(), backticks). Generate a proper random key (e.g. openssl rand -hex 32) and hardcode it in .env');
 }
 
 export function authenticateToken(req, res, next) {

server.js

@@ -70,7 +70,7 @@ app.use(cookieParser(process.env.COOKIE_SECRET));
 
 const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
-  max: 10,
+  max: 20,
   message: { error: 'Too many attempts, try again later' },
   standardHeaders: true,
   legacyHeaders: false,