diff --git a/advanced_security_middleware.py b/advanced_security_middleware.py
new file mode 100644
index 0000000..981b848
--- /dev/null
+++ b/advanced_security_middleware.py
@@ -0,0 +1,463 @@
+# File: advanced_security_middleware.py
+# Enhanced security middleware for QR Attendance System
+
+from functools import wraps
+from flask import request, session, jsonify, current_app, g
+import hashlib
+import secrets
+import jwt
+from datetime import datetime, timedelta
+import re
+from collections import defaultdict, deque
+import time
+import hmac
+import base64
+import os
+
+# Try to import cryptography, fallback if not available
+try:
+ from cryptography.fernet import Fernet
+ HAS_CRYPTOGRAPHY = True
+except ImportError:
+ HAS_CRYPTOGRAPHY = False
+
+class SecurityManager:
+ """
+ Advanced security manager for QR Attendance System
+ """
+
+ def __init__(self, app=None, db=None, logger_handler=None):
+ self.app = app
+ self.db = db
+ self.logger_handler = logger_handler
+
+ # Security tracking
+ self.failed_attempts = defaultdict(lambda: deque(maxlen=10))
+ self.suspicious_ips = defaultdict(int)
+ self.session_tokens = {}
+
+ # Security configuration
+ self.max_failed_attempts = 5
+ self.lockout_duration = 900 # 15 minutes
+ self.session_timeout = 3600 # 1 hour
+
+ if app:
+ self.init_app(app, db, logger_handler)
+
+ def init_app(self, app, db, logger_handler):
+ """Initialize security manager with Flask app"""
+ self.app = app
+ self.db = db
+ self.logger_handler = logger_handler
+
+ # Generate encryption key for sensitive data
+ self.setup_encryption()
+
+ # Register security middleware
+ app.before_request(self.security_check)
+
+ # Register security routes
+ self.register_security_routes()
+
+ def setup_encryption(self):
+ """Setup encryption for sensitive data"""
+ if HAS_CRYPTOGRAPHY:
+ encryption_key = self.app.config.get('ENCRYPTION_KEY')
+ if not encryption_key:
+ # Generate a new key (should be stored securely in production)
+ encryption_key = Fernet.generate_key()
+ if self.logger_handler:
+ self.logger_handler.logger.warning(
+ "Generated new encryption key - store this securely!"
+ )
+
+ self.cipher = Fernet(encryption_key)
+ else:
+ self.cipher = None
+ if self.logger_handler:
+ self.logger_handler.logger.warning(
+ "Cryptography not available - encryption features disabled"
+ )
+
+ def security_check(self):
+ """Comprehensive security check before each request"""
+ client_ip = self.get_client_ip()
+
+ # Check for suspicious activity
+ if self.is_suspicious_request():
+ self.log_security_event('suspicious_request', {
+ 'ip': client_ip,
+ 'user_agent': request.headers.get('User-Agent', ''),
+ 'endpoint': request.endpoint,
+ 'method': request.method
+ })
+ return jsonify({'error': 'Request blocked for security reasons'}), 403
+
+ # Validate session security
+ if 'user_id' in session:
+ if not self.validate_session_security():
+ session.clear()
+ return jsonify({'error': 'Session security validation failed'}), 401
+
+ # Check for SQL injection attempts
+ if self.detect_sql_injection():
+ self.log_security_event('sql_injection_attempt', {
+ 'ip': client_ip,
+ 'query_params': dict(request.args),
+ 'form_data': dict(request.form) if request.form else {}
+ })
+ return jsonify({'error': 'Malicious request detected'}), 403
+
+ # Rate limiting for authentication endpoints
+ if request.endpoint in ['login', 'register', 'reset_password']:
+ if self.is_auth_rate_limited():
+ return jsonify({
+ 'error': 'Too many attempts, please try again later'
+ }), 429
+
+ def get_client_ip(self):
+ """Get real client IP address"""
+ # Check for forwarded headers (in case behind proxy/CDN)
+ forwarded_ips = request.headers.getlist('X-Forwarded-For')
+ if forwarded_ips:
+ return forwarded_ips[0].split(',')[0].strip()
+
+ return request.headers.get('X-Real-IP') or request.remote_addr
+
+ def is_suspicious_request(self):
+ """Detect suspicious request patterns"""
+ client_ip = self.get_client_ip()
+ user_agent = request.headers.get('User-Agent', '').lower()
+
+ # Check for common attack patterns
+ suspicious_patterns = [
+ r'
{% if turnstile_enabled %}
-
+
{% endif %}