GoFileBeam implements comprehensive security measures to prevent abuse, spam, DDoS attacks, and phishing attempts.

• Token Bucket Algorithm per IP address
• Configurable requests per minute (default: 60)
• Gradual token refill over time
• Automatic IP blocking after repeated violations

✅ Per-IP rate limiting
✅ Automatic token refill
✅ Progressive blocking (5 violations = 15 min block)
✅ Automatic cleanup of old records
✅ Handles proxy headers (X-Forwarded-For, X-Real-IP)

GOFILEBEAM_RATE_LIMIT_PER_MINUTE=60

• Normal usage: Tokens refill gradually
• Burst traffic: Allowed up to rate limit
• Sustained abuse: IP blocked for 15 minutes
• Repeated abuse: Longer blocks

• Track failed password attempts per file + IP
• Block after 5 failed attempts within 10 minutes
• 30-minute block duration
• Automatic reset on successful authentication

✅ Per-file + IP tracking
✅ Time-window based detection
✅ Automatic blocking
✅ Automatic unblocking after timeout
✅ Reset on successful auth

Attempt 1-4: Allowed
Attempt 5 (within 10 min): IP blocked for 30 minutes
Successful auth: Counter reset
After 10 min: Counter reset if < 5 attempts

• Dictionary attacks
• Brute force attacks
• Credential stuffing
• Automated password guessing

GoFileBeam allows users to share any file type (.exe, .sh, .bat, scripts, etc.) because:

• Blocking file types is ineffective (easily bypassed by renaming)
• Limits legitimate use cases
• Security is handled by filesystem sandbox instead

✅ Length limit (255 characters)
✅ Null byte detection
✅ Path traversal prevention (../, /, \)
✅ Dangerous character sanitization

✅ Files stored with 0644 permissions (no execute on creation)
✅ Files changed to 0444 after upload (read-only, no execute)
✅ Path validation (files cannot escape uploads/ directory)
✅ Optional: noexec mount flag (Linux)

How it works:

1. File uploaded → stored with 0644 (rw-r--r--)
2. Sandbox applied → changed to 0444 (r--r--r--)
3. Execute bits removed → file cannot run on server
4. Write bits removed → file cannot be modified

Example:

$ ls -l uploads/
-r--r--r-- 1 user user 1024 May 29 18:00 malware.exe
-r--r--r-- 1 user user 2048 May 29 18:01 script.sh

$ ./uploads/malware.exe
bash: Permission denied  ✓ Blocked by filesystem!

For extra security, mount uploads directory with noexec flag:

sudo mount -o remount,noexec ./uploads

This prevents any file execution, even if permissions change.

Traditional approach (blocking file types):

• ❌ Blocks .exe, .sh, .bat, etc.
• ❌ Easily bypassed (rename .exe to .txt)
• ❌ Limits legitimate use cases
• ❌ Doesn't prevent actual execution

GoFileBeam approach (filesystem sandbox):

• ✅ Allow all file types
• ✅ Prevent execution via filesystem permissions
• ✅ Cannot be bypassed
• ✅ Users can share anything safely

# Sandbox is always enabled
# Files automatically secured after upload
# No configuration needed

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000

• MIME type sniffing attacks
• Clickjacking
• Cross-site scripting (XSS)
• Man-in-the-middle attacks
• Content injection

✅ TLS 1.3 support
✅ Strong cipher suites
✅ Certificate validation
✅ HSTS header

GOFILEBEAM_ENABLE_HTTPS=true
GOFILEBEAM_TLS_CERT_PATH=/path/to/cert.pem
GOFILEBEAM_TLS_KEY_PATH=/path/to/key.pem

✅ Configurable total storage limit
✅ Per-file size limits
✅ Real-time usage tracking
✅ Automatic rejection when full

GOFILEBEAM_MAX_STORAGE_GB=1
GOFILEBEAM_MAX_FILE_SIZE_MB=100

✅ Time-based expiration
✅ Download-count based expiration
✅ Automatic cleanup
✅ Secure deletion

• 1 Download or 1 Day
• 10 Downloads or 7 Days
• 100 Downloads or 30 Days

✅ Rate limiting per IP
✅ File size limits
✅ Storage quota enforcement
✅ Dangerous file type blocking
✅ Content validation

✅ Rate limiting per IP
✅ Brute force protection
✅ Download count limits
✅ Time-based expiration

✅ No public file listing
✅ No search functionality
✅ Unique file IDs (not guessable)
✅ No user accounts (no spam targets)

✅ Rate limiting
✅ Connection limits
✅ Request timeouts
✅ Automatic IP blocking

✅ Dangerous file type blocking
✅ Double extension detection
✅ Content scanning for phishing patterns
✅ HTML/JavaScript validation

✅ No URL shortening
✅ Clear file IDs in URLs
✅ Download page shows file info
✅ Password protection available

✅ Clear UI warnings for dangerous files
✅ File type indicators
✅ Expiration information displayed
✅ Download confirmation

✅ Upload attempts (IP, timestamp, file size)
✅ Download attempts (IP, timestamp, file ID)
✅ Failed password attempts
✅ Rate limit violations
✅ Blocked IPs
✅ File deletions

❌ File contents
❌ Passwords
❌ Decrypted data
❌ User personal information

• Automatic cleanup of old logs
• Configurable retention period
• Privacy-preserving logging

// In main.go
import "gofilebeam/internal/security"

// Create security components
rateLimiter := security.NewRateLimiter(cfg.RateLimitPerMinute)
bruteForce := security.NewBruteForceProtection()
fileValidator := security.NewFileValidator()

// Add to handlers
handler := handlers.NewHandler(storage, cfg, rateLimiter, bruteForce, fileValidator)

func rateLimitMiddleware(rl *security.RateLimiter, next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        ip := security.GetClientIP(r)
        
        if !rl.Allow(ip) {
            http.Error(w, "Rate limit exceeded", http.StatusTooManyRequests)
            return
        }
        
        next.ServeHTTP(w, r)
    })
}

// In upload handler
if err := fileValidator.ValidateFilename(filename); err != nil {
    http.Error(w, "Invalid filename", http.StatusBadRequest)
    return
}

if err := fileValidator.ValidateContent(data, filename); err != nil {
    http.Error(w, "Suspicious file content", http.StatusBadRequest)
    return
}

// In download handler
if bruteForce.IsBlocked(fileID, ip) {
    http.Error(w, "Too many failed attempts", http.StatusTooManyRequests)
    return
}

// On failed password
if !passwordValid {
    if !bruteForce.RecordFailedAttempt(fileID, ip) {
        http.Error(w, "Blocked due to too many failed attempts", http.StatusTooManyRequests)
        return
    }
    http.Error(w, "Invalid password", http.StatusUnauthorized)
    return
}

// On successful auth
bruteForce.ResetAttempts(fileID, ip)

- Upload rate per IP
- Failed password attempts
- Blocked IPs count
- Storage usage
- File type distribution
- Average file size
- Download patterns

⚠️ Sustained high upload rate from single IP
⚠️ Many failed password attempts
⚠️ Unusual file types
⚠️ Storage quota approaching limit
⚠️ Spike in blocked IPs

GOFILEBEAM_MAX_FILE_SIZE_MB=10
GOFILEBEAM_RATE_LIMIT_PER_MINUTE=10
GOFILEBEAM_MAX_STORAGE_GB=0.5
GOFILEBEAM_ENABLE_HTTPS=true
# All file types allowed - security via sandbox

GOFILEBEAM_MAX_FILE_SIZE_MB=500
GOFILEBEAM_RATE_LIMIT_PER_MINUTE=120
GOFILEBEAM_MAX_STORAGE_GB=10
# All file types allowed - security via sandbox

• Enable HTTPS with valid certificate
• Configure appropriate rate limits
• Set reasonable storage quotas
• Enable file validation
• Configure logging
• Set up monitoring
• Test brute force protection
• Review security headers
• Configure firewall rules
• Set up backup system
• Document incident response plan
• Test DDoS mitigation
• Review file type restrictions
• Enable automatic cleanup
• Configure alerting

1. DDoS Attack:

   # Reduce rate limit
   GOFILEBEAM_RATE_LIMIT_PER_MINUTE=10
   
   # Check blocked IPs
   grep "Rate limit exceeded" /var/log/gofilebeam.log
   
   # Add firewall rules for top offenders

2. Brute Force Attack:

   # Check failed attempts
   grep "Invalid password" /var/log/gofilebeam.log
   
   # Identify targeted files
   # Consider deleting compromised files

3. Storage Abuse:

   # Reduce storage limit
   GOFILEBEAM_MAX_STORAGE_GB=0.5
   
   # Reduce file size limit
   GOFILEBEAM_MAX_FILE_SIZE_MB=10
   
   # Clean up old files

4. Malware Upload:

   # Sandbox is always active - files cannot execute
   
   # Optionally scan uploads directory
   clamscan -r /var/gofilebeam/uploads
   
   # Delete suspicious files if needed

• OWASP Top 10
• CWE Top 25
• NIST Cybersecurity Framework
• Go Security Best Practices

GoFileBeam - Secure by design, protected by default.