fix: corrige 6 bugs mineurs (BUG-035 a BUG-040)

backend/collab.py

@@ -44,6 +44,9 @@ MAX_UPDATE_BYTES = 8 * 1024 * 1024
 #: Taille maximale d'un snapshot texte (protection anti-abus).
 MAX_TEXT_CHARS = 8 * 1024 * 1024
 
+#: Taille maximale d'un message brut reçu (protection anti-abus, BUG-036).
+MAX_MESSAGE_CHARS = 16 * 1024 * 1024
+
 #: Palette de couleurs attribuées aux utilisateurs (curseurs + avatars).
 PEER_COLORS = [
     "#e6194b", "#3cb44b", "#4363d8", "#f58231", "#911eb4",
@@ -68,9 +71,13 @@ def authenticate_websocket(websocket: WebSocket) -> dict[str, Any] | None:
     """Authenticate a WebSocket connection.
 
     Mirrors :func:`backend.auth.middleware.get_current_user` but works on the
-    WebSocket scope: the JWT is read from the ``access_token`` cookie (sent
-    automatically by same-origin browsers during the handshake) or, as a
-    fallback, from the ``token`` query parameter.
+    WebSocket scope: the JWT is read from the ``access_token`` cookie, which
+    same-origin browsers send automatically during the handshake.
+
+    BUG-036: the token is **never** accepted from the query string anymore —
+    URLs end up in access logs, proxies and browser history. Browsers cannot
+    set custom headers on a WebSocket handshake, so the HttpOnly cookie set at
+    login is the only supported transport.
 
     Returns the user dict, or ``None`` if authentication fails.
     """
@@ -88,7 +95,7 @@ def authenticate_websocket(websocket: WebSocket) -> dict[str, Any] | None:
             "_token_vaults": ["*"],
         }
 
-    token = websocket.query_params.get("token") or websocket.cookies.get("access_token")
+    token = websocket.cookies.get("access_token")
     if not token:
         return None
 
@@ -274,6 +281,9 @@ class CollabManager:
 
     # -- message handling ---------------------------------------------------
     async def _on_message(self, room: CollabRoom, client: CollabClient, raw: str) -> None:
+        # BUG-036: drop oversized frames before parsing them.
+        if not isinstance(raw, str) or len(raw) > MAX_MESSAGE_CHARS:
+            return
         try:
             message = json.loads(raw)
         except (ValueError, TypeError):