Feat/multi 465 467 468 469

[zaytherr]

Summary of Changes

• Issue [security] Missing HTTPS enforcement #468: Enforce HTTPS redirects (308) for safe methods, reject state-changing HTTP requests with 403, configure Express trust proxy, validate redirect hosts against allowlist to prevent host header injection, exempt health/metrics endpoints, and attach Strict-Transport-Security on secure responses.
• Issue [bug] Session expiry not enforced #469: Enforce server-side session expiry with dual-window absolute lifetime and idle timeout in UTC, reject JWT tokens missing exp claim, throttle last-activity writes to Redis, invalidate sessions on logout, align cookie lifetime with server expiry, and handle legacy sessions safely.
• Issue [security] No CSRF protection #465: Implement global CSRF protection denying state-changing requests by default, authenticate via custom X-CSRF-Token header validated with timing-safe HMAC verification, validate Origin/Referer against allowed origins, reject method-override attempts, provide /csrf-token endpoint, and add X-CSRF-Token to CORS headers.
• Issue [enhancement] Add metrics endpoint #467: Implement zero-dependency Prometheus text exposition exporter at GET /metrics with HTTP request duration histogram and count labeled by route template, process metrics, subsystem telemetry (Redis, cache, circuits, webhooks), and constant-time auth protection.

Closes #465
Closes #467
Closes #468
Closes #469

[drips-wave]

@zaytherr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits