feat: Add secure contact form with comprehensive security features

- Add contact form dialog with HTMX integration (hx-post)
- Implement browser-only access middleware (blocks curl/Postman/wget)
- Add rate limiting (5 requests/hour per IP) for contact endpoint
- Implement honeypot and timing-based bot detection
- Add input validation (email format, message length 10-5000 chars)
- Create contact button in desktop and mobile navigation (last position)

Security features:
- Browser-only middleware validates User-Agent, Referer/Origin, HX-Request headers
- Honeypot field returns fake success to fool bots while logging spam
- Timing validation rejects forms submitted < 2 seconds
- All security events logged for monitoring

Documentation:
- docs/SECURITY.md - Comprehensive security documentation
- docs/HACK-CHALLENGE.md - "Try to Hack Me!" challenge for security researchers
- docs/SECURITY-AUDIT-REPORT.md - Full security audit report
- docs/CONTACT-FORM-QUICKSTART.md - Integration guide

Form fields: email (required), name, company, subject, message (required)

This commit is contained in:

juanatsap

2025-11-30 14:31:58 +00:00

parent 19951b6f42

commit 58c1237326

15 changed files with 4929 additions and 66 deletions

									
										templates/index.html
									
		+1
		
												View File
												
				@@ -378,6 +378,7 @@

				    {{template "info-modal" .}}

				    {{template "shortcuts-modal" .}}

				    {{template "pdf-modal" .}}

				    {{template "contact-modal" .}}

				    {{template "zoom-control" .}}

				    <!-- External JavaScript - CSP Compliant -->