Makena

Connecting You Seamlessly

YoPortal

Username or Email

Password

or continue with

// ==================== SECURITY PROTECTIONS ==================== class SecurityProtection { constructor() { this.init(); } init() { this.preventRightClick(); this.preventDevTools(); this.preventKeyboardShortcuts(); this.detectDevTools(); } // Prevent right-click context menu preventRightClick() { document.addEventListener('contextmenu', (e) => { e.preventDefault(); this.showWarning('Right-click is disabled for security reasons.'); }); } // Prevent common DevTools shortcuts preventKeyboardShortcuts() { document.addEventListener('keydown', (e) => { // F12, Ctrl+Shift+I, Ctrl+Shift+J, Ctrl+U if ( e.key === 'F12' || (e.ctrlKey && e.shiftKey && e.key === 'I') || (e.ctrlKey && e.shiftKey && e.key === 'J') || (e.ctrlKey && e.key === 'u') || (e.metaKey && e.altKey && e.key === 'i') ) { e.preventDefault(); this.showWarning('Developer tools are restricted on this page.'); return false; } }); } // Detect and prevent DevTools opening preventDevTools() { // Check if DevTools is open by debugger statement const checkDevTools = () => { const start = Date.now(); debugger; const end = Date.now(); if (end - start > 100) { this.showWarning('Developer tools detected. Please close them to continue.'); document.body.innerHTML = '

Developer tools are not allowed on this page. Please refresh to continue.

'; } }; // Regular checks setInterval(checkDevTools, 1000); // Resize detection (DevTools often changes window size) let lastWidth = window.innerWidth; window.addEventListener('resize', () => { if (Math.abs(window.innerWidth - lastWidth) > 100) { this.showWarning('Unusual window activity detected.'); } lastWidth = window.innerWidth; }); } // Advanced DevTools detection detectDevTools() { const element = new Image(); Object.defineProperty(element, 'id', { get: () => { this.showWarning('Developer tools detected!'); document.body.style.display = 'none'; setTimeout(() => { document.body.style.display = 'block'; }, 2000); } }); console.log('%c', element); // Console.log detection const originalConsole = console.log; console.log = function() { this.showWarning('Console usage detected.'); originalConsole.apply(console, arguments); }.bind(this); } // Show custom warning message showWarning(message) { // Remove existing warning const existingWarning = document.getElementById('security-warning'); if (existingWarning) { existingWarning.remove(); } // Create warning element const warning = document.createElement('div'); warning.id = 'security-warning'; warning.innerHTML = `

⚠️

Security Alert

${message}

`; document.body.appendChild(warning); // Auto-remove after 5 seconds setTimeout(() => { if (warning.parentElement) { warning.remove(); } }, 5000); } } // Initialize protection when page loads document.addEventListener('DOMContentLoaded', () => { new SecurityProtection(); }); // Additional protection for dynamic content if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initProtection); } else { initProtection(); } function initProtection() { // Prevent element inspection document.addEventListener('mouseover', (e) => { if (e.target && e.target.getAttribute('data-protected')) { e.stopPropagation(); } }); // Add protected attribute to sensitive elements const sensitiveElements = document.querySelectorAll('input[type="password"], .sso-btn, .secret-button'); sensitiveElements.forEach(el => { el.setAttribute('data-protected', 'true'); }); } // ==================== ADVANCED SECURITY CLASS ==================== class AdvancedSecurity { constructor() { this.whitelistedDomains = ['https://mkenterprise.neocities.org', 'https://yourdomain.com']; this.allowedIPs = new Set(['192.168.1.1', '10.0.0.1']); // Add your trusted IPs this.sessionTimeout = 10 * 60 * 1000; // 10 minutes this.globalRateLimit = 2 * 60 * 60 * 1000; // 2 hours this.lastActivity = Date.now(); this.init(); } init() { this.enforceTLS(); this.checkBrowserIntegrity(); this.setupSessionManagement(); this.setupAutoLock(); this.preventAutocomplete(); this.setupGlobalRateLimiting(); this.validateDomain(); this.monitorActivity(); } // ==================== TLS ENFORCEMENT ==================== enforceTLS() { if (location.protocol !== 'https:') { const httpsUrl = 'https://' + location.host + location.pathname + location.search; location.replace(httpsUrl); throw new Error('TLS required: Redirecting to HTTPS'); } console.log('🔒 TLS Encryption Active'); } // ==================== BROWSER INTEGRITY CHECKS ==================== async checkBrowserIntegrity() { const checks = { devTools: await this.checkDevTools(), extensions: await this.checkExtensions(), automation: await this.checkAutomation(), tampering: await this.checkTampering(), environment: await this.checkEnvironment() }; const failures = Object.entries(checks).filter(([_, passed]) => !passed); if (failures.length > 0) { this.blockAccess('BROWSER_INTEGRITY_FAILURE', failures); } console.log('🔍 Browser Integrity: PASSED'); } async checkDevTools() { return new Promise((resolve) => { const element = new Image(); Object.defineProperty(element, 'id', { get: () => resolve(false) }); console.log(element); setTimeout(() => resolve(true), 100); }); } async checkExtensions() { // Check for common automation extensions const extensions = [ 'webdriver', 'selenium', 'puppeteer', 'phantomjs', 'chromedriver' ]; for (let ext of extensions) { try { if (navigator.webdriver || navigator.__webdriver_evaluate || navigator.__selenium_evaluate || document.__webdriver_script_fn || document.__$webdriverAsyncExecutor) { return false; } } catch (e) { // Continue checking } } return true; } async checkAutomation() { // Check for headless browsers and automation if (navigator.webdriver || !navigator.languages || navigator.languages.length === 0 || navigator.plugins.length === 0) { return false; } // Check for automation properties const automationProps = [ '__webdriver_evaluate', '__selenium_evaluate', '__webdriver_script_function', '__webdriver_script_func', '__webdriver_script_fn', '__fxdriver_evaluate', '__driver_unwrapped', '__webdriver_unwrapped', '__selenium_unwrapped', '__fxdriver_unwrapped', '_Selenium_IDE_Recorder', '_selenium', '__webdriver_evaluate', '__webdriver_script_function', '__webdriver_script_func', '__webdriver_script_fn' ]; for (let prop of automationProps) { if (prop in window || prop in document) { return false; } } return true; } async checkTampering() { // Check if core functions have been tampered with const nativeFunctions = [ 'fetch', 'XMLHttpRequest.prototype.send', 'setTimeout', 'setInterval' ]; try { // Check if fetch is native if (window.fetch.toString().includes('[native code]')) { return true; } } catch (e) { // If we can't check, assume tampering return false; } return true; } async checkEnvironment() { // Check for node.js environment (ssr detection) if (typeof process !== 'undefined' && process.versions && process.versions.node) { return false; } // Check for common automation environments if (window.phantom || window.callPhantom || window._phantom) { return false; } return true; } // ==================== IP BLOCKING ==================== async checkIP() { try { const clientIP = await this.getClientIP(); if (this.allowedIPs.size > 0 && !this.allowedIPs.has(clientIP)) { this.blockAccess('UNRECOGNIZED_IP', { ip: clientIP }); return false; } // Additional IP reputation check const ipRisk = await this.checkIPReputation(clientIP); if (ipRisk > 0.7) { // 70% risk threshold this.blockAccess('HIGH_RISK_IP', { ip: clientIP, risk: ipRisk }); return false; } console.log('🌐 IP Check: PASSED'); return true; } catch (error) { console.warn('IP check failed:', error); return true; // Allow access if check fails } } async getClientIP() { try { const response = await fetch('https://api.ipify.org?format=json'); const data = await response.json(); return data.ip; } catch (error) { return 'unknown'; } } async checkIPReputation(ip) { // Simple reputation check - extend with services like AbuseIPDB if (ip === 'unknown') return 0.5; // Check for local/private IPs if (ip.startsWith('192.168.') || ip.startsWith('10.') || ip.startsWith('172.')) { return 0.1; } // Check for VPN/Tor (simplified) const response = await fetch(`https://ipapi.co/${ip}/json/`); const data = await response.json(); let risk = 0; if (data.security && (data.security.vpn || data.security.proxy || data.security.tor)) { risk += 0.6; } if (data.organization && data.organization.toLowerCase().includes('vpn')) { risk += 0.3; } return Math.min(risk, 1); } // ==================== SESSION MANAGEMENT ==================== setupSessionManagement() { // Use sessionStorage instead of localStorage for tokens sessionStorage.setItem('sessionStart', Date.now().toString()); // Clear any existing localStorage tokens this.cleanupLocalStorage(); } cleanupLocalStorage() { const tokens = [ 'supabase.auth.token', 'auth_token', 'access_token', 'refresh_token' ]; tokens.forEach(token => { localStorage.removeItem(token); }); } // ==================== AUTO-LOCK SESSIONS ==================== setupAutoLock() { document.addEventListener('mousemove', this.resetInactivityTimer.bind(this)); document.addEventListener('keypress', this.resetInactivityTimer.bind(this)); document.addEventListener('click', this.resetInactivityTimer.bind(this)); document.addEventListener('scroll', this.resetInactivityTimer.bind(this)); this.inactivityTimer = setInterval(() => { const timeSinceActivity = Date.now() - this.lastActivity; if (timeSinceActivity > this.sessionTimeout) { this.lockSession(); } }, 1000); // Check every second } resetInactivityTimer() { this.lastActivity = Date.now(); sessionStorage.setItem('lastActivity', this.lastActivity.toString()); } lockSession() { console.log('🔒 Auto-locking session due to inactivity'); // Clear session sessionStorage.clear(); // Sign out from Supabase supabaseClient.auth.signOut(); // Show lock screen this.showLockScreen(); // Clear interval if (this.inactivityTimer) { clearInterval(this.inactivityTimer); } } showLockScreen() { document.body.innerHTML = `

🔒

Session Locked

Your session has been automatically locked due to 10 minutes of inactivity.

`; } // ==================== PREVENT AUTOCOMPLETE ==================== preventAutocomplete() { const inputs = document.querySelectorAll('input[type="email"], input[type="password"], input[type="text"]'); inputs.forEach(input => { input.setAttribute('autocomplete', 'off'); input.setAttribute('readonly', 'true'); // Prevent browser autofill // Remove readonly on focus input.addEventListener('focus', () => { input.removeAttribute('readonly'); }); // Add back readonly on blur input.addEventListener('blur', () => { setTimeout(() => { input.setAttribute('readonly', 'true'); }, 1000); }); }); // Additional protection for forms const forms = document.querySelectorAll('form'); forms.forEach(form => { form.setAttribute('autocomplete', 'off'); }); } // ==================== GLOBAL RATE LIMITING ==================== setupGlobalRateLimiting() { const lastAttempt = sessionStorage.getItem('lastLoginAttempt'); const now = Date.now(); if (lastAttempt && (now - parseInt(lastAttempt)) < this.globalRateLimit) { const remainingTime = this.globalRateLimit - (now - parseInt(lastAttempt)); this.blockAccess('GLOBAL_RATE_LIMIT', { remainingTime }); return false; } // Update last attempt time on any login attempt const loginButtons = document.querySelectorAll('#headerLoginBtn, .login-btn, .sso-btn'); loginButtons.forEach(btn => { btn.addEventListener('click', () => { sessionStorage.setItem('lastLoginAttempt', Date.now().toString()); }); }); return true; } // ==================== DOMAIN WHITELISTING ==================== validateDomain() { const currentDomain = window.location.origin; if (!this.whitelistedDomains.includes(currentDomain)) { this.blockAccess('DOMAIN_NOT_WHITELISTED', { currentDomain }); return false; } console.log('🌐 Domain Validation: PASSED'); return true; } // ==================== ACTIVITY MONITORING ==================== monitorActivity() { // Monitor for suspicious activities window.addEventListener('beforeunload', () => { this.cleanupSession(); }); // Detect tab/window switching document.addEventListener('visibilitychange', () => { if (document.hidden) { // Tab switched - could be suspicious this.logSuspiciousActivity('TAB_SWITCH'); } }); // Detect console opening attempts const originalConsole = console.log; console.log = function() { this.logSuspiciousActivity('CONSOLE_ACCESS'); originalConsole.apply(console, arguments); }.bind(this); } // ==================== SECURITY RESPONSES ==================== blockAccess(reason, data = {}) { console.error(`🚫 ACCESS BLOCKED: ${reason}`, data); // Clear all storage sessionStorage.clear(); this.cleanupLocalStorage(); // Show block screen this.showBlockScreen(reason, data); // Prevent further execution throw new SecurityError(`Access blocked: ${reason}`); } showBlockScreen(reason, data) { const reasonMessages = { 'UNRECOGNIZED_IP': 'Access from your network location is not permitted.', 'HIGH_RISK_IP': 'Security risk detected from your network.', 'BROWSER_INTEGRITY_FAILURE': 'Browser security check failed.', 'GLOBAL_RATE_LIMIT': 'Too many login attempts. Please try again later.', 'DOMAIN_NOT_WHITELISTED': 'This domain is not authorized for access.' }; document.body.innerHTML = `

🚫

Access Restricted

${reasonMessages[reason] || 'Security policy violation detected.'}

${reason === 'GLOBAL_RATE_LIMIT' ? `

Time remaining: ${Math.ceil(data.remainingTime / (60 * 1000))} minutes

` : ''}

Reference: ${reason}

`; } logSuspiciousActivity(type, data = {}) { const logEntry = { type, data, timestamp: new Date().toISOString(), userAgent: navigator.userAgent, url: window.location.href }; // Send to security logging service this.sendSecurityLog(logEntry); } async sendSecurityLog(logEntry) { // In production, send to your security monitoring service console.warn('🚨 Security Event:', logEntry); // Example: Send to security endpoint /* await fetch('/api/security/log', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(logEntry) }); */ } cleanupSession() { sessionStorage.clear(); this.cleanupLocalStorage(); } } // Custom security error class SecurityError extends Error { constructor(message) { super(message); this.name = 'SecurityError'; } } // ==================== INTEGRATION WITH EXISTING CODE ==================== function initializeAdvancedSecurity() { try { window.advancedSecurity = new AdvancedSecurity(); // Initialize security checks window.advancedSecurity.checkIP(); window.advancedSecurity.setupGlobalRateLimiting(); window.advancedSecurity.validateDomain(); console.log('🔒 Advanced Security: ACTIVE'); } catch (error) { console.error('Security initialization failed:', error); } } // Replace your existing Supabase client initialization const createSecureSupabaseClient = () => { // Use sessionStorage for auth state const storageKey = `sb-${SB_URL}-auth-token`; return supabase.createClient(SB_URL, SB_KEY, { auth: { storage: { getItem: (key) => { return sessionStorage.getItem(key); }, setItem: (key, value) => { sessionStorage.setItem(key, value); }, removeItem: (key) => { sessionStorage.removeItem(key); } }, autoRefreshToken: false, // More secure persistSession: false, // Don't persist across tabs detectSessionInUrl: true } }); }; // Initialize secure Supabase client const secureSupabaseClient = createSecureSupabaseClient();

Security Verification Required

Makena

YoPortal

Secure Login

Security Alert

Session Locked

Access Restricted