Security Review Prompt Templates

## Security Vulnerabilities Found

### 1. SQL Injection (Critical)

**Vulnerable code (Line 12):**
```javascript
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
```

**Exploitation:**
```bash
curl -X POST /login -d "email=' OR '1'='1' --&password=anything"
# Returns first user in database, likely admin
```

**Secure fix:**
```javascript
const query = 'SELECT * FROM users WHERE email = ?';
const [rows] = await db.execute(query, [req.body.email]);
```

---

### 2. Timing Attack on Password Comparison (High)

**Vulnerable code (Line 18):**
```javascript
if (user.password === req.body.password) {
```

**Exploitation:** String comparison exits on first mismatch. Attacker can measure response times to guess password character by character.

**Secure fix:**
```javascript
const crypto = require('crypto');

// Constant-time comparison
const isMatch = crypto.timingSafeEqual(
 Buffer.from(storedHash),
 Buffer.from(computedHash)
);
```

---

### 3. No Password Hashing (Critical)

**Issue:** Passwords appear to be stored/compared as plaintext.

**Secure fix:**
```javascript
const bcrypt = require('bcrypt');

// On registration
const hashedPassword = await bcrypt.hash(password, 12);

// On login
const isValid = await bcrypt.compare(req.body.password, user.hashedPassword);
```

---

### 4. Missing Rate Limiting (Medium)

**Issue:** No protection against brute force attacks.

**Secure fix:**
```javascript
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
 windowMs: 15 * 60 * 1000, // 15 minutes
 max: 5, // 5 attempts
 message: 'Too many login attempts, try again later'
});

app.post('/login', loginLimiter, loginHandler);
```

---

### 5. Verbose Error Messages (Low)

**Issue (Line 20):**
```javascript
return res.status(401).json({ error: 'User not found' });
// vs
return res.status(401).json({ error: 'Incorrect password' });
```

**Exploitation:** Tells attacker which emails are registered.

**Secure fix:** Same message for both cases:
```javascript
return res.status(401).json({ error: 'Invalid email or password' });
```

## Input Validation Schema

```typescript
import { z } from 'zod';
import xss from 'xss';

// Custom refinements
const sanitizeString = (val: string) => xss(val.trim());

const isNotDisposableEmail = (email: string) => {
 const disposableDomains = ['tempmail.com', 'throwaway.com'];
 const domain = email.split('@')[1];
 return !disposableDomains.includes(domain);
};

const isSafeUrl = (url: string) => {
 try {
 const parsed = new URL(url);
 // Prevent SSRF: only allow http(s), no internal IPs
 if (!['http:', 'https:'].includes(parsed.protocol)) return false;
 const ip = parsed.hostname;
 if (ip.startsWith('127.') || ip.startsWith('10.') || 
 ip.startsWith('192.168.') || ip === 'localhost') return false;
 return true;
 } catch {
 return false;
 }
};

// Registration schema
export const CreateUserSchema = z.object({
 email: z
.string()
.email('Invalid email format')
.max(254, 'Email too long')
.toLowerCase()
.refine(isNotDisposableEmail, 'Disposable emails not allowed'),

 password: z
.string()
.min(8, 'Password must be at least 8 characters')
.max(128, 'Password too long') // Prevent DoS via bcrypt
.regex(
 /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/,
 'Password must contain uppercase, lowercase, and number'
 ),

 name: z
.string()
.min(1, 'Name is required')
.max(100, 'Name too long')
.transform(sanitizeString), // XSS protection

 bio: z
.string()
.max(500, 'Bio too long')
.optional()
.transform((val) => val ? sanitizeString(val) : val),

 birthdate: z
.string()
.regex(/^\d{4}-\d{2}-\d{2}$/, 'Use YYYY-MM-DD format')
.refine((date) => {
 const age = Math.floor(
 (Date.now() - new Date(date).getTime()) / (365.25 * 24 * 60 * 60 * 1000)
 );
 return age >= 13;
 }, 'Must be at least 13 years old'),

 website: z
.string()
.url('Invalid URL')
.refine(isSafeUrl, 'Invalid website URL')
.optional(),
});

export type CreateUserInput = z.infer<typeof CreateUserSchema>;
```

## Middleware Usage

```typescript
import { Request, Response, NextFunction } from 'express';

export const validateCreateUser = (
 req: Request,
 res: Response,
 next: NextFunction
) => {
 const result = CreateUserSchema.safeParse(req.body);

 if (!result.success) {
 return res.status(400).json({
 error: 'VALIDATION_ERROR',
 details: result.error.errors.map((e) => ({
 field: e.path.join('.'),
 message: e.message,
 })),
 });
 }

 // Replace body with validated & sanitized data
 req.body = result.data;
 next();
};
```

## Edge Cases Handled

| Input | Handling |
|-------|----------|
| `<script>alert(1)</script>` in name | Sanitized to empty/escaped |
| `http://169.254.169.254/` (AWS metadata) | Rejected by SSRF check |
| Very long password | Capped at 128 to prevent bcrypt DoS |
| Unicode homoglyphs in email | Consider punycode normalization |
| Birthdate `9999-12-31` | Fails age check (negative age) |

## Authentication Security Review

### ✅ Good Practices Observed

1. **Refresh token in httpOnly cookie** - Prevents XSS from stealing long-lived token
2. **Access token in memory** - Not persisted, cleared on tab close
3. **Short access token expiry (15min)** - Limits window of compromise
4. **Refresh tokens in Redis** - Enables revocation

### ⚠️ Issues Found

#### 1. JWT Secret Weakness (High)

**Issue (Line 8):**
```javascript
const secret = process.env.JWT_SECRET || 'fallback-secret';
```

**Problem:** Fallback secret in code. If env var is missing, all tokens signed with known value.

**Fix:**
```javascript
const secret = process.env.JWT_SECRET;
if (!secret || secret.length < 32) {
 throw new Error('JWT_SECRET must be set and at least 32 characters');
}
```

#### 2. Missing Token Type Validation (High)

**Issue:** Access token and refresh token use same structure.

**Attack:** Use refresh token as access token to bypass expiration.

**Fix:** Add token type claim:
```javascript
// Access token
const accessToken = jwt.sign(
 { userId, type: 'access' },
 secret,
 { expiresIn: '15m' }
);

// Verification middleware
if (decoded.type !== 'access') {
 throw new Error('Invalid token type');
}
```

#### 3. Refresh Token Rotation Missing (Medium)

**Issue:** Refresh token reused until expiry.

**Attack:** Stolen refresh token grants indefinite access.

**Fix:** Rotate on use:
```javascript
async function refreshAccessToken(refreshToken) {
 const payload = jwt.verify(refreshToken, secret);
 
 // Check if token is in Redis (not already used)
 const exists = await redis.get(`refresh:${refreshToken}`);
 if (!exists) throw new Error('Token revoked or already used');
 
 // Delete old token
 await redis.del(`refresh:${refreshToken}`);
 
 // Issue new refresh token
 const newRefreshToken = generateRefreshToken(payload.userId);
 await redis.setex(`refresh:${newRefreshToken}`, 7 * 24 * 60 * 60, payload.userId);
 
 return {
 accessToken: generateAccessToken(payload.userId),
 refreshToken: newRefreshToken
 };
}
```

#### 4. No Refresh Token Family Tracking (Medium)

**Issue:** If attacker uses stolen refresh token before user, user's next refresh fails but attacker continues.

**Fix:** Track token families and revoke entire family on reuse detection.

### Security Checklist

| Control | Status |
|---------|--------|
| Passwords hashed (bcrypt) | ✅ |
| httpOnly cookie for refresh | ✅ |
| Secure cookie flag | ⚠️ Check production |
| SameSite cookie attribute | ❌ Add SameSite=Strict |
| Token expiration | ✅ |
| Token revocation | ✅ Via Redis |
| Rate limiting on login | ❌ Add |
| Account lockout | ❌ Add |

## Security Headers Configuration

### Express.js Middleware (using Helmet)

```javascript
const helmet = require('helmet');

app.use(helmet({
 // Content Security Policy - prevents XSS
 contentSecurityPolicy: {
 directives: {
 defaultSrc: ["'self'"],
 scriptSrc: [
 "'self'",
 "https://js.stripe.com", // Stripe
 // Avoid 'unsafe-inline' if possible
 ],
 styleSrc: [
 "'self'",
 "https://fonts.googleapis.com",
 "'unsafe-inline'", // Often needed for CSS-in-JS
 ],
 fontSrc: [
 "'self'",
 "https://fonts.gstatic.com",
 ],
 imgSrc: ["'self'", "data:", "https:"],
 connectSrc: [
 "'self'",
 "https://api.stripe.com",
 ],
 frameSrc: [
 "https://js.stripe.com", // Stripe iframe
 ],
 frameAncestors: ["'none'"], // Prevent clickjacking
 objectSrc: ["'none'"],
 upgradeInsecureRequests: [],
 },
 },
 
 // Prevent MIME sniffing
 noSniff: true,
 
 // XSS filter (legacy browsers)
 xssFilter: true,
 
 // Prevent clickjacking
 frameguard: { action: 'deny' },
 
 // HSTS - force HTTPS
 hsts: {
 maxAge: 31536000, // 1 year
 includeSubDomains: true,
 preload: true,
 },
 
 // Hide Express
 hidePoweredBy: true,
 
 // Referrer policy
 referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

// Additional headers for API routes
app.use('/api', (req, res, next) => {
 res.setHeader('Content-Type', 'application/json');
 res.setHeader('Cache-Control', 'no-store'); // Don't cache API responses
 next();
});
```

### Nginx Configuration

```nginx
server {
 #... SSL config...

 # Security headers
 add_header X-Frame-Options "DENY" always;
 add_header X-Content-Type-Options "nosniff" always;
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
 
 # CSP (if not set by app)
 add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://js.stripe.com;..." always;
 
 # Permissions Policy (formerly Feature-Policy)
 add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
}
```

### Header Explanations

| Header | Value | Prevents |
|--------|-------|----------|
| Content-Security-Policy | Allowlist | XSS, data injection |
| X-Frame-Options | DENY | Clickjacking |
| X-Content-Type-Options | nosniff | MIME-type attacks |
| Strict-Transport-Security | max-age=... | Protocol downgrade |
| Referrer-Policy | strict-origin | URL leakage |
| Permissions-Policy | deny features | Unwanted API access |

### Testing

**Online tools:**
- https://securityheaders.com - Grade your headers
- https://observatory.mozilla.org - Mozilla's scanner

**Manual check:**
```bash
curl -I https://yoursite.com
```

**Expected grade:** A or A+ on securityheaders.com

### SOC2 Compliance Notes

✅ Required for SOC2:
- HSTS with 1-year max-age
- Content-Security-Policy
- X-Frame-Options or CSP frame-ancestors

⚠️ Document any CSP exceptions (unsafe-inline) with justification