Security Practices

Security Practices Skill

Purpose: Apply security best practices to protect applications

Overview

This skill provides security guidelines following OWASP standards and industry best practices.

Authentication

Password Security

// Use bcrypt with cost factor 12
import bcrypt from "bcrypt";

const SALT_ROUNDS = 12;

async function hashPassword(password: string): Promise<string> {
  return bcrypt.hash(password, SALT_ROUNDS);
}

async function verifyPassword(
  password: string,
  hash: string,
): Promise<boolean> {
  return bcrypt.compare(password, hash);
}

JWT Best Practices

// Short-lived access tokens
const accessToken = jwt.sign(payload, SECRET, { expiresIn: "15m" });

// Longer-lived refresh tokens (stored securely)
const refreshToken = jwt.sign({ userId }, REFRESH_SECRET, { expiresIn: "7d" });

Input Validation

Never Trust User Input

// SQL Injection vulnerable
const query = `SELECT * FROM users WHERE id = ${userId}`;

// Parameterized query
const user = await prisma.user.findUnique({ where: { id: userId } });

Sanitize Output

// XSS vulnerable
element.innerHTML = userInput;

// Escape HTML
import DOMPurify from "dompurify";
element.innerHTML = DOMPurify.sanitize(userInput);

OWASP Top 10 Checklist

Security Headers

// Express/NestJS helmet middleware
app.use(helmet());

// Or manually:
res.setHeader("X-Content-Type-Options", "nosniff");
res.setHeader("X-Frame-Options", "DENY");
res.setHeader("X-XSS-Protection", "1; mode=block");
res.setHeader(
  "Strict-Transport-Security",
  "max-age=31536000; includeSubDomains",
);
res.setHeader("Content-Security-Policy", "default-src 'self'");

Secrets Management

# Never commit secrets
# .env file with API_KEY=sk-1234...

# Use environment variables
export API_KEY=$(vault read secret/api-key)

# Use secret managers
# AWS Secrets Manager, HashiCorp Vault, etc.

Zero Trust Principles

Zero Trust assumes no implicit trust for any entity inside or outside the network perimeter. Every access request is fully authenticated, authorized, and encrypted before granting access.

OAuth 2.0 / OpenID Connect Flows

Flow Selection Matrix

Token Storage Requirements

// NEVER store access tokens in localStorage (XSS-accessible)
// NEVER store tokens in sessionStorage for long-lived sessions

// Use httpOnly, Secure, SameSite cookies for refresh tokens
res.cookie("refresh_token", token, {
  httpOnly: true,
  secure: true,
  sameSite: "strict",
  maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
  path: "/api/auth/refresh",
});

// Keep access tokens in memory only (JS variable)
// They are short-lived (15 min) and re-obtained via refresh

PKCE Implementation

import crypto from "crypto";

// Generate code verifier (43-128 chars, unreserved URI characters)
function generateCodeVerifier(): string {
  return crypto.randomBytes(32).toString("base64url");
}

// Derive code challenge from verifier
function generateCodeChallenge(verifier: string): string {
  return crypto.createHash("sha256").update(verifier).digest("base64url");
}

// All public clients MUST use PKCE (RFC 7636)
// Send code_challenge with authorization request
// Send code_verifier with token exchange request

API Security

Rate Limiting Patterns

import rateLimit from "express-rate-limit";

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: (req) => req.user?.id ?? req.ip,
});

app.use("/api/", apiLimiter);

API Key Management

• Rotate keys on a regular schedule (90 days max) and immediately on suspected compromise
• Scope keys to specific endpoints, methods, and IP ranges
• Never embed keys in client-side code or version control
• Use separate keys for each environment (dev, staging, production)
• Log key usage to detect anomalous patterns

Request Signing

// Sign requests with HMAC to prevent tampering
import crypto from "crypto";

function signRequest(payload: string, secret: string): string {
  return crypto.createHmac("sha256", secret).update(payload).digest("hex");
}

// Verify on server side; reject requests with invalid or expired signatures
// Include timestamp in signed payload to prevent replay attacks

API Versioning Security

• Deprecate and remove old API versions that lack current security controls
• Apply the same authentication and authorization to all active versions
• Monitor traffic to deprecated versions for potential abuse
• Never maintain insecure legacy endpoints for backward compatibility

Supply Chain Security

Dependency Auditing

# Run audit on every CI build
npm audit --audit-level=high

# Fix known vulnerabilities
npm audit fix

# Use lockfile-only installs in CI to prevent supply chain attacks
npm ci

Lockfile Integrity

• Always commit package-lock.json to version control
• Use npm ci in CI/CD pipelines (installs from lockfile exactly)
• Review lockfile diffs in pull requests for unexpected changes
• Enable lockfile-lint to enforce registry and integrity hash policies

Dependency Pinning

{
  "dependencies": {
    "express": "4.18.2",
    "prisma": "5.10.0"
  }
}

• Pin exact versions in production applications (no ^ or ~)
• Use Dependabot or Renovate for controlled, reviewed updates
• Separate security patches from feature updates in dependency PRs

Typosquatting Detection

• Verify package publisher and download counts before installing
• Use npm config set ignore-scripts true for initial installs, then review scripts
• Consider using Socket.dev or Snyk to detect malicious packages automatically

Quick Reference