PrivateChat
The security-enhanced end-to-end encrypted chat system supports AES-256 + RSA-2048 double encryption, message revocation, administrator management and other functions.
### : Log in to the app - ** Administrator account **: `admin` - ** Default password **: `Admin@2025` - ** Encryption password **: Leave blank to use the default value `PrivateChat2025Secure!` ###Usage Instructions 1. ** Multi-user chat **: All users must use the same encrypted password to see each other's messages 2. ** Message withdrawal **: Message can be withdrawn within 2 minutes after sending 3. ** Administrator functions **: Log in to the admin account to access user management, system announcements and other functions new features Administrator delete user function: Administrators can delete user accounts (cannot delete themselves) Mobile keyboard optimization: The keyboard does not retract after sending a message, and the input box remains focused Online user number display fix: correctly display the number of online users RSA encrypted login: The login password is transmitted using RSA-2048 encryption to prevent clear text leakage security enhancement RSA-2048 Key Exchange: Login passwords are transmitted using asymmetric encryption PKCS #1 v1.5 compatible: Supports JSEncrypt front-end library encryption format Password transmission encryption: The network cannot obtain a clear password after grabbing a packet Fixed password storage problem: bcrypt hash is no longer encrypted twice Comprehensive security upgrade Fixed bare except statement: All exception catches use specific exception types Strict CORS configuration: Cross-domain requests are prohibited by default, and allowed domain names need to be clearly configured AES-256-CBC encryption: AES-256-CBC mode is used uniformly for both front and back ends, fully compatible with CryptoJS Fix memory leak: Rate limiter adds regular cleanup mechanism to prevent unlimited growth Secure HTTP headers: Add security response headers such as X-Frame-Options, CSP, and HSTS Password history check: Prevent users from repeatedly using recent passwords (default record 5) Refresh Token mechanism: Support token refresh and extend session duration (default 7 days) Fixed session protection: Limit the maximum number of active sessions per user (default 5) Eliminate magic numbers: Move all hard-coded constants to configuration files Input validation enhancement: add stricter input validation rules Database query optimization: Add user information cache to improve query performance Log Mask Tool: Sensitive information is automatically masked in logs Configuration Verification: Verify the legitimacy of configuration parameters at startup Fix the Logger import problem: Fix the error where the Logger is not defined in encryption.py WebSocket connection repair: Fixed the problem where WebSocket was disconnected immediately after connection the following APIs are added DELETE /api/admin/user/{username}: Delete user (administrator) POST /api/auth/refresh: Refresh access token Password History Table: Record user password change history Refresh Token Table: Manage long-term valid refresh tokens Configuration Item New PASSWORD_HISTORY_COUNT: Number of password history records (default: 5) REFRESH_TOKEN_EXPIRE_DAYS: Fresh token validity period (default: 7 days) MAX_ACTIVE_SESSIONS: Maximum number of active sessions per user (default: 5) IP_LOCK_MINUTES: IP lock duration (default: 30 minutes) IP_LOCK_THRESHOLD: The number of failures to trigger IP lock (default: 20) RATE_LIMIT_MAX_IPS: Maximum IP number of rate limiter (default: 10000)
