Security Review

OWASP Top 10 (2021)

Use this as a baseline checklist when reviewing any application for security vulnerabilities.

A01: Broken Access Control

Users acting outside their intended permissions.

// VULNERABLE: No authorization check
app.get('/api/users/:id', async (req, res) => {
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
  res.json(user);
});

// FIXED: Verify the requesting user has permission
app.get('/api/users/:id', authenticate, async (req, res) => {
  if (req.user.id !== req.params.id && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
  res.json(user);
});

A02: Cryptographic Failures

Use TLS 1.2+ for all data in transit. Hash passwords with bcrypt (cost 12+) or argon2.
Never use MD5 or SHA-1 for password hashing. Encrypt data at rest with AES-256-GCM.

A03: Injection

# VULNERABLE: SQL injection via string concatenation
cursor.execute(f"SELECT * FROM users WHERE name = '{user_input}'")

# FIXED: Parameterized query
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))

A04: Insecure Design

Rate limit authentication endpoints. Use CAPTCHA for public forms.
Apply least privilege. Threat model before building, not after.

A05: Security Misconfiguration

Disable directory listing. Remove default credentials and demo accounts.
Disable verbose errors in production. Review cloud IAM policies.

A06: Vulnerable and Outdated Components

npm audit          # Node.js
pip-audit          # Python
bundle audit       # Ruby

A07: Identification and Authentication Failures

Enforce strong password policies (length over complexity). Account lockout after repeated failures.
MFA for sensitive operations. Invalidate sessions on logout and password change.

A08: Software and Data Integrity Failures

Verify dependency integrity (lock files, checksums). Sign releases. Protect CI/CD pipelines.

A09: Security Logging and Monitoring Failures

Log all authentication events, authorization failures, and input validation failures.
Ensure logs are tamper-proof and retained.

A10: Server-Side Request Forgery (SSRF)

Application fetches a URL provided by the user without validation.

// VULNERABLE: User controls the URL
app.get('/fetch', async (req, res) => {
  const response = await fetch(req.query.url);
  res.send(await response.text());
});

// FIXED: Allowlist of permitted domains
const ALLOWED_HOSTS = ['api.trusted-service.com'];
app.get('/fetch', async (req, res) => {
  const url = new URL(req.query.url);
  if (!ALLOWED_HOSTS.includes(url.hostname)) {
    return res.status(400).json({ error: 'Domain not allowed' });
  }
  res.send(await (await fetch(url.toString())).text());
});

Authentication Patterns

Password Hashing

// Node.js with bcrypt
const bcrypt = require('bcrypt');
const SALT_ROUNDS = 12;
const hash = await bcrypt.hash(password, SALT_ROUNDS);          // Hash
const isValid = await bcrypt.compare(candidatePassword, storedHash); // Verify

# Python with argon2
from argon2 import PasswordHasher
ph = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=4)
hash = ph.hash(password)           # Hash
ph.verify(hash, candidate_password) # Verify — raises VerifyMismatchError on failure

Session Management

Practice	Description
Regenerate session ID on login	Prevents session fixation attacks
Set `HttpOnly` flag on cookies	Prevents JavaScript access to session cookie
Set `Secure` flag on cookies	Ensures cookie sent only over HTTPS
Set `SameSite=Strict` or `Lax`	Prevents CSRF via cookie
Expire sessions after inactivity	Limit window of exposure for stolen sessions
Invalidate on logout	Server-side session destruction

JWT Best Practices

Do	Do Not
Use asymmetric signing (RS256, ES256) for distributed systems	Use `none` algorithm
Set short expiration (`exp`) — 15 minutes for access tokens	Store sensitive data in JWT payload
Validate `iss`, `aud`, `exp`, and `nbf` claims	Use JWT as a session replacement for long-lived sessions
Store refresh tokens securely (HttpOnly cookie or server-side)	Store JWTs in localStorage (XSS risk)
Rotate signing keys periodically	Accept tokens with missing or invalid signatures

Multi-Factor Authentication

Support TOTP (Time-based One-Time Password) as baseline MFA.
Offer WebAuthn / passkeys as a phishing-resistant option.
Provide recovery codes as a backup (store hashed, single-use).
Require MFA re-verification for sensitive operations (password change, payment).

Authorization

RBAC (Role-Based Access Control)

// Middleware pattern for RBAC
function requireRole(...roles) {
  return (req, res, next) => {
    if (!req.user) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    if (!roles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
}

// Usage
app.delete('/api/users/:id', authenticate, requireRole('admin'), deleteUser);
app.get('/api/reports', authenticate, requireRole('admin', 'manager'), getReports);

ABAC (Attribute-Based Access Control)

// Policy-based authorization
function authorize(policy) {
  return (req, res, next) => {
    const ctx = { user: req.user, resource: req.resource, action: req.method };
    if (!policy.evaluate(ctx)) return res.status(403).json({ error: 'Access denied' });
    next();
  };
}

// Policy: Users can edit their own posts; admins can edit any post
const editPostPolicy = {
  evaluate: (ctx) => ctx.user.role === 'admin' || ctx.resource.author_id === ctx.user.id,
};

Input Validation

SQL Injection

// VULNERABLE
const query = `SELECT * FROM products WHERE name = '${userInput}'`;

// FIXED: Parameterized queries
const result = await db.query('SELECT * FROM products WHERE name = $1', [userInput]);

Cross-Site Scripting (XSS)

// VULNERABLE: Inserting user input directly into HTML
element.innerHTML = userInput;

// FIXED: Use textContent for plain text
element.textContent = userInput;

// FIXED: Use a sanitization library for rich content
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userInput);

CSRF (Cross-Site Request Forgery)

// Server-side: Generate and validate CSRF tokens
const csrf = require('csurf');
const csrfProtection = csrf({ cookie: { httpOnly: true, sameSite: 'strict' } });

app.get('/form', csrfProtection, (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});
app.post('/submit', csrfProtection, (req, res) => {
  handleSubmission(req.body); // Token validated automatically by middleware
});

// Client-side: <input type="hidden" name="_csrf" value="{{csrfToken}}">

Command Injection

// VULNERABLE: User input passed to shell command
const { exec } = require('child_process');
exec(`convert ${userFilename} output.png`);

// FIXED: Use execFile with arguments array (no shell interpolation)
const { execFile } = require('child_process');
execFile('convert', [userFilename, 'output.png']);

Path Traversal

// VULNERABLE: User controls file path
app.get('/files/:name', (req, res) => res.sendFile(`/uploads/${req.params.name}`));

// FIXED: Resolve and validate path stays within allowed directory
const path = require('path');
app.get('/files/:name', (req, res) => {
  const safePath = path.resolve('/uploads', req.params.name);
  if (!safePath.startsWith('/uploads/')) return res.status(400).json({ error: 'Invalid path' });
  res.sendFile(safePath);
});

Secrets Management

Rules

Rule	Details
Never commit secrets to version control	Use `.gitignore` for `.env` files; use `git-secrets` or `trufflehog` to scan
Use environment variables for runtime config	Load via `.env` in development, platform config in production
Rotate secrets regularly	Automate rotation where possible (AWS Secrets Manager, HashiCorp Vault)
Use least-privilege credentials	Database users should only have necessary grants
Audit secret access	Log when secrets are read and by whom

.gitignore Entries for Secrets

.env
.env.local
.env.production
.env.*.local
*.pem
*.key
*.p12
credentials.json
service-account.json

HTTPS and CORS

// HTTPS enforcement middleware
app.use((req, res, next) => {
  if (req.headers['x-forwarded-proto'] !== 'https' && process.env.NODE_ENV === 'production') {
    return res.redirect(301, `https://${req.hostname}${req.url}`);
  }
  next();
});

// Restrictive CORS — specify exact origins
const cors = require('cors');
app.use(cors({
  origin: ['https://app.example.com', 'https://admin.example.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400,
}));

Security Headers

Implement these headers on all responses:

Header	Value	Purpose
`Strict-Transport-Security`	`max-age=63072000; includeSubDomains; preload`	Force HTTPS
`X-Content-Type-Options`	`nosniff`	Prevent MIME-type sniffing
`X-Frame-Options`	`DENY` or `SAMEORIGIN`	Prevent clickjacking
`Content-Security-Policy`	See below	Prevent XSS and data injection
`Referrer-Policy`	`strict-origin-when-cross-origin`	Control referrer leakage
`Permissions-Policy`	`camera=(), microphone=(), geolocation=()`	Disable unused browser features
`X-XSS-Protection`	`0`	Disable legacy XSS filter (CSP supersedes it)

Content Security Policy Example

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'nonce-{random}';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https://cdn.example.com;
  font-src 'self' https://fonts.gstatic.com;
  connect-src 'self' https://api.example.com;
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';

Dependency Vulnerability Scanning

# Integrate into CI — fail on high or critical vulnerabilities
npm audit --audit-level=high     # Node.js
pip-audit                        # Python
bundle audit                     # Ruby
cargo audit                      # Rust
govulncheck ./...                # Go
snyk test                        # Multi-language (commercial)
trivy fs --security-checks vuln . # Container and filesystem

Security Logging

Log these: authentication attempts (success and failure), authorization failures, input validation failures, rate limit triggers, administrative actions, security setting changes.

Never log these: passwords, full credit card numbers, SSNs, session tokens, API keys, personal health information.

Security Review Checklist

Before merging any code, verify:

security-review