feat: Add secure contact form with comprehensive security features

- Add contact form dialog with HTMX integration (hx-post)
- Implement browser-only access middleware (blocks curl/Postman/wget)
- Add rate limiting (5 requests/hour per IP) for contact endpoint
- Implement honeypot and timing-based bot detection
- Add input validation (email format, message length 10-5000 chars)
- Create contact button in desktop and mobile navigation (last position)

Security features:
- Browser-only middleware validates User-Agent, Referer/Origin, HX-Request headers
- Honeypot field returns fake success to fool bots while logging spam
- Timing validation rejects forms submitted < 2 seconds
- All security events logged for monitoring

Documentation:
- docs/SECURITY.md - Comprehensive security documentation
- docs/HACK-CHALLENGE.md - "Try to Hack Me!" challenge for security researchers
- docs/SECURITY-AUDIT-REPORT.md - Full security audit report
- docs/CONTACT-FORM-QUICKSTART.md - Integration guide

Form fields: email (required), name, company, subject, message (required)

This commit is contained in:

juanatsap

2025-11-30 14:31:58 +00:00

parent 19951b6f42

commit 58c1237326

15 changed files with 4929 additions and 66 deletions

									
										static/css/main.css
									
		+1
		
												View File
												
				@@ -34,6 +34,7 @@

				@import './04-interactive/_modals.css';

				@import './04-interactive/_toasts.css';

				@import './04-interactive/_zoom-control.css';

				@import './04-interactive/_contact-form.css';

				/* 05 - Responsive */

				@import './05-responsive/_breakpoints.css';