bf8a9260bd
This commit addresses all CRITICAL and MEDIUM security vulnerabilities
identified in the security audit with environment-aware configuration.
## Docker Compose Profiles
- Added docker-compose.dev.yml for development (relaxed security)
- Added docker-compose.prod.yml for production (strict security)
- Environment-specific configurations for rate limiting, CSRF, logging
## CRITICAL Fixes (P0)
1. Fixed insecure random number generation
- Replaced Math.random() with crypto.randomBytes() for verification codes
- Now cryptographically secure
2. Implemented rate limiting
- express-rate-limit for all endpoints
- Strict limits on auth endpoints (5 attempts in dev=off, prod=5)
- Email endpoint limits (20 in dev, 3 in prod)
- API-wide rate limiting
3. Added request body size limits
- Development: 50MB (for testing)
- Production: 10KB (security)
4. Fixed user enumeration vulnerability
- Generic error message for registration
- No disclosure of which field exists
5. Added security headers
- helmet.js with CSP, HSTS, XSS protection
- No-sniff, hide powered-by headers
## MEDIUM Fixes (P1)
6. Strengthened password policy
- Environment-aware validation (8+ chars)
- Production: requires uppercase, lowercase, number
- Development: relaxed for testing
7. Enhanced input validation
- Validation for all auth endpoints
- WSDC ID validation (numeric, max 10 digits)
- Name validation (safe characters only)
- Email normalization
8. Added input sanitization
- DOMPurify for XSS prevention
- Sanitize all user inputs in emails
- Timing-safe string comparison for tokens
9. Improved error handling
- Generic errors in production
- Detailed errors only in development
- Proper error logging
10. Enhanced CORS configuration
- Whitelist-based origin validation
- Environment-specific allowed origins
- Credentials support
## New Files
- backend/src/config/security.js - Environment-aware security config
- backend/src/middleware/rateLimiter.js - Rate limiting middleware
- backend/src/utils/sanitize.js - Input sanitization utilities
- backend/.env.example - Development environment template
- backend/.env.production.example - Production environment template
- docker-compose.dev.yml - Development overrides
- docker-compose.prod.yml - Production configuration
- docs/DEPLOYMENT.md - Complete deployment guide
- docs/SECURITY_AUDIT.md - Full security audit report
- .gitignore - Updated to exclude .env files
## Dependencies Added
- helmet (^8.1.0) - Security headers
- express-rate-limit (^8.2.1) - Rate limiting
- dompurify (^3.3.0) - XSS prevention
- jsdom (^27.2.0) - DOM manipulation for sanitization
## Testing
- ✅ Password validation works (weak passwords rejected)
- ✅ User enumeration fixed (generic error messages)
- ✅ WSDC lookup functional
- ✅ Registration flow working
- ✅ Rate limiting active (environment-aware)
- ✅ Security headers present
## Usage
Development:
docker compose -f docker-compose.yml -f docker-compose.dev.yml up
Production:
docker compose -f docker-compose.yml -f docker-compose.prod.yml up
See docs/DEPLOYMENT.md for detailed instructions.
59 lines
1.4 KiB
JSON
59 lines
1.4 KiB
JSON
{
|
|
"name": "spotlightcam-backend",
|
|
"version": "1.0.0",
|
|
"description": "Backend API for spotlight.cam - P2P video exchange for dance events",
|
|
"main": "src/server.js",
|
|
"scripts": {
|
|
"start": "node src/server.js",
|
|
"dev": "nodemon src/server.js",
|
|
"test": "jest --coverage",
|
|
"test:watch": "jest --watch",
|
|
"prisma:generate": "prisma generate",
|
|
"prisma:migrate": "prisma migrate dev",
|
|
"prisma:seed": "node prisma/seed.js",
|
|
"prisma:studio": "prisma studio"
|
|
},
|
|
"keywords": [
|
|
"webrtc",
|
|
"p2p",
|
|
"video",
|
|
"dance",
|
|
"matchmaking"
|
|
],
|
|
"author": "",
|
|
"license": "ISC",
|
|
"dependencies": {
|
|
"@aws-sdk/client-ses": "^3.930.0",
|
|
"@prisma/client": "^5.8.0",
|
|
"bcryptjs": "^2.4.3",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.5",
|
|
"csurf": "^1.11.0",
|
|
"dompurify": "^3.3.0",
|
|
"dotenv": "^16.3.1",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^8.2.1",
|
|
"express-validator": "^7.3.0",
|
|
"helmet": "^8.1.0",
|
|
"jsdom": "^27.2.0",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"socket.io": "^4.8.1"
|
|
},
|
|
"devDependencies": {
|
|
"jest": "^29.7.0",
|
|
"nodemon": "^3.0.2",
|
|
"prisma": "^5.8.0",
|
|
"socket.io-client": "^4.8.1",
|
|
"supertest": "^6.3.3"
|
|
},
|
|
"jest": {
|
|
"testEnvironment": "node",
|
|
"coveragePathIgnorePatterns": [
|
|
"/node_modules/"
|
|
],
|
|
"testMatch": [
|
|
"**/__tests__/**/*.test.js"
|
|
]
|
|
}
|
|
}
|