kjhjason / kjhjason.com

My Portfolio + Blog Web Application

kjhjason.com

This is the source code for my personal website, kjhjason.com.

Note: The website design is inspired by leerob/leerob.io.

Tech Stack

Backend

• Actix Web (Rust)
• MongoDB Atlas

Frontend

• Askama Templates
  • Pre-compiled templates for server-side rendering.
• Tailwind CSS
  • DaisyUI
• htmx
• pdf.js
  • Mainly for previewing my resume

Deployment

• Docker
• Cloudflare
  • R2 for storing blog files like images
  • Reverse Proxy for bot protection and caching
• Fly.io

Security

• Automated attacks are mitigated using Cloudflare's turnstile CAPTCHA solution.
• Passwords are hashed using Argon2.
• TOTP secrets for 2FA are encrypted using XChaCha20-Poly1305 before being stored in the database.
• Nonces are generated with rand::thread_rng() that is cryptographically secure and are usually 32 bytes long.
• Implemented various middleware for enhanced security to adhere to OWASP Top 10 guidelines:
  • Content Security Policy.
  • Cross-Site Request Forgery.
    • Uses HMAC-SHA1 for CSRF tokens via hmac-serialiser.
  • HTTP Strict Transport Security.
  • Authentication using HMAC-SHA512 via hmac-serialiser for a shorter but secure tokens instead of using JSON Web Tokens (JWT).
    • hmac-serialiser uses implementations by RustCrypto.

kjhjason.com's Issues

Add 2FA to auth

You may actually allow for an enumeration attack by HTTP status code

Hey there!

I just had a quick glance, but to me it seems like you do indeed allow for an enumeration attack by HTTP status core, although you wanted to avoid it by using the same error message as with an actual wrong username and or password.

https://github.com/KJHJason/Blog/blob/b6116a1883734154cd62cc6424d4ac642d483bbc/api/src/model/auth.rs#L59

Ignore my comment if that's totally intended, I just wanted to help!

Add Comments

Probably not going to be implemented in the near future.
But put it here as planned.

Testimonial page