Security Best Practices

// validate-review.mjs
import { Router } from 'express';

export const router = Router();

const MAX_COMMENT = 2000;

// Builds a new object from known fields only; anything else in the body is dropped.
function parseReview(body) {
  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
    return { error: 'Body must be a JSON object' };
  }
  const rating = Number(body.rating);
  if (!Number.isInteger(rating) || rating < 1 || rating > 5) {
    return { error: 'rating must be an integer from 1 to 5' };
  }
  if (typeof body.comment !== 'string' || body.comment.length > MAX_COMMENT) {
    return { error: `comment must be a string of at most ${MAX_COMMENT} characters` };
  }
  return { value: { rating, comment: body.comment.trim() } };
}

router.post('/books/:bookId/reviews', (req, res) => {
  const { value, error } = parseReview(req.body);
  if (error) {
    return res.status(422).json({ title: 'Validation failed', detail: error, status: 422 });
  }
  // The author comes from the authenticated session, never from the body.
  const review = { ...value, bookId: req.params.bookId, authorId: req.user?.id };
  res.status(201).json(review);
});

// safe-queries.mjs
import { basename } from 'node:path';
import { Router } from 'express';
import pg from 'pg';

const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });
export const router = Router();

const SORTABLE = new Map([
  ['title', 'title'],
  ['published', 'published_at'],
]);

router.get('/books', async (req, res) => {
  const { author, sort = 'title' } = req.query;

  // The sort column is chosen from an allow-list, never interpolated from input.
  const column = SORTABLE.get(String(sort));
  if (!column) {
    return res.status(400).json({ title: 'Unknown sort field', status: 400 });
  }

  // The value travels as a bound parameter ($1), never inside the SQL text.
  const { rows } = await pool.query(
    `SELECT id, title FROM books WHERE ($1::text IS NULL OR author = $1) ORDER BY ${column}`,
    [typeof author === 'string' ? author : null],
  );
  res.json(rows);
});

router.get('/covers/:file', (req, res) => {
  // basename() strips directories; root makes sendFile refuse anything outside it.
  res.sendFile(basename(req.params.file), { root: 'covers', dotfiles: 'deny' });
});

// safe-redirect.mjs
import { Router } from 'express';

export const router = Router();

const ORIGIN = new URL(process.env.PUBLIC_ORIGIN ?? 'https://bookshelf.example');

// Returns a same-origin path or the fallback; never an absolute URL to another site.
export function safeRedirectTarget(candidate, fallback = '/') {
  if (typeof candidate !== 'string') {
    return fallback;
  }
  try {
    const url = new URL(candidate, ORIGIN);
    if (url.origin !== ORIGIN.origin) {
      return fallback;
    }
    return `${url.pathname}${url.search}${url.hash}`;
  } catch {
    return fallback;
  }
}

router.post('/login/complete', (req, res) => {
  res.redirect(303, safeRedirectTarget(req.body?.next));
});

// helmet-csp.mjs
import { randomBytes } from 'node:crypto';
import express from 'express';
import helmet from 'helmet';

const app = express();

// A fresh, unguessable nonce for every response.
app.use((req, res, next) => {
  res.locals.cspNonce = randomBytes(16).toString('base64');
  next();
});

app.use(
  helmet({
    contentSecurityPolicy: {
      // Start from Helmet's defaults and change only what the app needs.
      useDefaults: true,
      directives: {
        'script-src': ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
        'img-src': ["'self'", 'data:', 'https://covers.example.com'],
        'connect-src': ["'self'", 'https://api.bookshelf.example'],
        'frame-ancestors': ["'none'"],
        // Send violation reports to your own collector.
        'report-uri': ['/csp-report'],
      },
      // Observe first, enforce later: set to true to use Content-Security-Policy-Report-Only.
      reportOnly: false,
    },
    // Public cover images are fetched by other sites, so relax this one header.
    crossOriginResourcePolicy: { policy: 'cross-origin' },
    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
    strictTransportSecurity: { maxAge: 31536000, includeSubDomains: true },
  }),
);

// Browsers post reports as application/csp-report or application/reports+json.
app.post(
  '/csp-report',
  express.json({ type: ['application/csp-report', 'application/reports+json', 'application/json'], limit: '10kb' }),
  (req, res) => {
    console.warn('CSP violation', JSON.stringify(req.body).slice(0, 2000));
    res.sendStatus(204);
  },
);

app.get('/', (req, res) => {
  res.type('html').send(`<!doctype html>
<title>Bookshelf</title>
<script nonce="${res.locals.cspNonce}">window.bookshelf = { ready: true };</script>`);
});

app.listen(3000);

// rate-limit.mjs
import express from 'express';
import { ipKeyGenerator, rateLimit } from 'express-rate-limit';

const app = express();

// The limiter keys on req.ip. Behind a proxy that is the proxy's address
// unless trust proxy is set, which would put every user in one bucket.
app.set('trust proxy', 1);

// A general ceiling for the whole API.
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  limit: 300, // per key and window ("limit" replaced the older "max" name)
  standardHeaders: 'draft-8', // RateLimit and RateLimit-Policy headers
  legacyHeaders: false, // no X-RateLimit-* headers
  ipv6Subnet: 56, // count a whole /56 as one client for IPv6
  handler: (req, res, next, options) => {
    res.status(options.statusCode).json({ title: 'Too many requests', status: options.statusCode });
  },
});

// Two much stricter limiters on the login route. Only failed attempts count in either.
// Per address: one client trying many accounts. ipKeyGenerator() applies the IPv6 subnet grouping.
const loginLimiterByIp = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 10,
  skipSuccessfulRequests: true,
  keyGenerator: (req) => ipKeyGenerator(req.ip),
  standardHeaders: 'draft-8',
  legacyHeaders: false,
});

// Per account: many addresses (a botnet) trying one account. Looser and longer, because an
// attacker can use it to lock the real user out.
const loginLimiterByAccount = rateLimit({
  windowMs: 60 * 60 * 1000,
  limit: 20,
  skipSuccessfulRequests: true,
  keyGenerator: (req) => `account:${String(req.body?.email ?? '').trim().toLowerCase()}`,
  standardHeaders: 'draft-8',
  legacyHeaders: false,
});

app.use(express.json({ limit: '100kb' }));
app.use('/api', apiLimiter);
app.post('/api/v1/login', loginLimiterByIp, loginLimiterByAccount, (req, res) => {
  // authenticate here; a failed attempt consumes quota, a success is not counted
  res.sendStatus(401);
});

app.listen(3000);

// rate-limit-redis.mjs
import { rateLimit } from 'express-rate-limit';
import { RedisStore } from 'rate-limit-redis';
import { createClient } from 'redis';

const client = createClient({ url: process.env.REDIS_URL });
await client.connect();

export const sharedLimiter = rateLimit({
  windowMs: 60 * 1000,
  limit: 100,
  standardHeaders: 'draft-8',
  legacyHeaders: false,
  store: new RedisStore({
    sendCommand: (...args) => client.sendCommand(args),
    prefix: 'rl:bookshelf:',
  }),
});

// login-bruteforce.mjs
import { Router } from 'express';
import { RateLimiterMemory } from 'rate-limiter-flexible';

// Swap RateLimiterMemory for RateLimiterRedis (same API) when running several processes.
const limiterByIpAndUser = new RateLimiterMemory({
  keyPrefix: 'login_ip_user',
  points: 5, // five failures...
  duration: 15 * 60, // ...per 15 minutes
  blockDuration: 15 * 60, // then blocked for 15 minutes
});

const limiterByUser = new RateLimiterMemory({
  keyPrefix: 'login_user',
  points: 20, // a slower limit that survives IP rotation
  duration: 60 * 60,
  blockDuration: 60 * 60,
});

export const loginRouter = Router();

loginRouter.post('/login', async (req, res) => {
  const email = String(req.body?.email ?? '').toLowerCase();
  const ipAndUser = `${req.ip}:${email}`;

  const [byIpAndUser, byUser] = await Promise.all([
    limiterByIpAndUser.get(ipAndUser),
    limiterByUser.get(email),
  ]);
  const retryMs = Math.max(
    byIpAndUser && byIpAndUser.remainingPoints <= 0 ? byIpAndUser.msBeforeNext : 0,
    byUser && byUser.remainingPoints <= 0 ? byUser.msBeforeNext : 0,
  );
  if (retryMs > 0) {
    res.set('Retry-After', String(Math.ceil(retryMs / 1000)));
    return res.status(429).json({ title: 'Too many failed attempts', status: 429 });
  }

  const ok = await verifyPassword(email, req.body?.password); // your authentication
  if (!ok) {
    await Promise.all([limiterByIpAndUser.consume(ipAndUser).catch(() => {}), limiterByUser.consume(email).catch(() => {})]);
    return res.status(401).json({ title: 'Invalid credentials', status: 401 });
  }

  await limiterByIpAndUser.delete(ipAndUser); // a success clears the address-level counter
  res.json({ ok: true });
});

async function verifyPassword(email, password) {
  return false; // placeholder: look up the user and compare a password hash
}

// csrf-sync.mjs
import express from 'express';
import session from 'express-session';
import { csrfSync } from 'csrf-sync';

const app = express();
app.set('trust proxy', 1);

app.use(express.json());
app.use(
  session({
    name: '__Host-bookshelf.sid',
    secret: process.env.SESSION_SECRET, // loaded from the environment, never committed
    resave: false,
    saveUninitialized: false,
    cookie: { httpOnly: true, secure: true, sameSite: 'lax', path: '/' },
  }),
);

const { generateToken, csrfSynchronisedProtection } = csrfSync({
  // Default is the x-csrf-token header; make that explicit.
  getTokenFromRequest: (req) => req.headers['x-csrf-token'],
});

// Safe method: hands the token to the front end (or put it in a rendered form instead).
app.get('/csrf-token', (req, res) => {
  res.json({ token: generateToken(req) });
});

// Everything registered after this line is protected for POST, PUT, PATCH and DELETE.
app.use(csrfSynchronisedProtection);

app.post('/api/v1/books/:id/reviews', (req, res) => {
  res.status(201).json({ created: true });
});

// A failed check raises a 403 error; render it like any other.
app.use((err, req, res, next) => {
  if (err.code === 'EBADCSRFTOKEN' || err.statusCode === 403) {
    return res.status(403).json({ title: 'Invalid CSRF token', status: 403 });
  }
  next(err);
});

app.listen(3000);

// csrf-csrf.mjs
import cookieParser from 'cookie-parser';
import { doubleCsrf } from 'csrf-csrf';
import express from 'express';
import session from 'express-session';

const app = express();
app.use(express.json());
app.use(session({ secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false }));
app.use(cookieParser());

const { generateCsrfToken, doubleCsrfProtection } = doubleCsrf({
  getSecret: () => process.env.CSRF_SECRET,
  getSessionIdentifier: (req) => req.session.id,
  cookieName: '__Host-bookshelf.x-csrf-token',
  cookieOptions: { sameSite: 'strict', path: '/', secure: true, httpOnly: true },
  getCsrfTokenFromRequest: (req) => req.headers['x-csrf-token'], // header only, no fallthrough chain
});

app.get('/csrf-token', (req, res) => {
  res.json({ token: generateCsrfToken(req, res) });
});

app.use(doubleCsrfProtection);

app.delete('/api/v1/books/:id', (req, res) => res.sendStatus(204));

app.listen(3000);

// fetch-metadata.mjs
const UNSAFE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
const ALLOWED_ORIGINS = new Set([process.env.PUBLIC_ORIGIN ?? 'https://bookshelf.example']);

export function rejectCrossSite(req, res, next) {
  if (!UNSAFE.has(req.method)) {
    return next();
  }
  const site = req.get('sec-fetch-site');
  if (site && site !== 'same-origin' && site !== 'none') {
    return res.status(403).json({ title: 'Cross-site request rejected', status: 403 });
  }
  const origin = req.get('origin');
  if (origin && !ALLOWED_ORIGINS.has(origin)) {
    return res.status(403).json({ title: 'Origin not allowed', status: 403 });
  }
  next();
}