Hyperion API

Appearance

v5
v4
v3
v2
v1

Language

English
French

Appearance

English
French

4.5.0 ​

API ​

API v4.5.0 — Security audit, rate limiting, hardening.

  • Fixed SSRF vulnerability in POST /hyperplanning: URL validation now enforces HTTPS, blocks private IPs (127.0.0.1, 192.168.x, 10.x, 169.254.169.254) and localhost, with a 10-second fetch timeout.
  • Fixed rate limit calculation: the per-minute counter was compared against the hourly limit, allowing up to 2,000 req/min instead of 2,000 req/h. Now cumulates all minutes of the current hour.
  • Fixed IP spoofing via cf-connecting-ip header: switched to req.ip (respects trust proxy) to prevent rate limit bypass.
  • Added burst rate limiting per plan (10-second window): Free 50, Advanced 80, Pro 120, Business 200.
  • Improved error handler: sensitive information (paths, ECONNREFUSED, stack traces) is now filtered from error messages. HTTP status is preserved instead of always returning 500.
  • Secured dynamic property access in routes: Object.hasOwn() is now used for algorithms[method], encode[method], textMod[method], validate[type] to prevent prototype access.
  • Added security headers: X-Content-Type-Options: nosniff and X-Frame-Options: DENY.
  • Fixed memory leak in rate limiter: inactive IPs and burst tracker entries are now cleaned up every hour.
  • Added body size limit: express.json() and express.urlencoded() are now limited to 10kb (returns 413 Payload Too Large).
  • Centralized plan configuration (plans.ts): hourly and burst limits per tier, overridable via environment variables.
  • Added 9 new tests (total 305): 4 SSRF unit tests and 5 security integration tests.

Documentation ​

  • Added burst rate limits to Authentication and Pricing pages.
  • Updated POST /hash Try panel with 11 new algorithms (sha224, sha512-224, sha512-256, sha3-224, sha3-256, sha3-384, sha3-512, blake2s256, ripemd160, shake128, shake256).
  • Updated GET /qrcode Try panel with format and correction dropdown options.
  • Updated GET /placeholder Try panel with new avatar and lines parameters.
  • Restructured responsive CSS to mobile-first with ascending breakpoints. Terminal is now only visible at 1280px+.