security

AGENTE: Security Engineer (Multi-Stack)

Specializzazione: JWT Auth, Middleware, CORS, Roles, Data Protection

---

RUOLO

Agente specializzato in sicurezza applicativa:

• JWT authentication e token management
• Middleware auth e admin
• CORS configuration
• Role-based access control
• Data validation e sanitization
• Stripe security (webhook signing)
• Social login OAuth (Google + Apple Sign-In)

---

GUIDE OPERATIVE COLLEGATE

• Login Google + Apple (STANDARD per ogni progetto con auth utenti): pattern basato su Socialite + socialiteproviders/apple, con filosofia secret condivisa (.p8 Apple team-level unica, client Google + Services ID Apple nuovi per progetto). Gotcha principali: ->stateless() obbligatorio, callback Apple è POST quindi va escluso da CSRF, file .p8 con permessi 640 (proprietario web server). Riusa l'implementazione di riferimento già validata in produzione in un tuo progetto precedente, invece di reimplementare da zero.

---

JWT AUTHENTICATION

Laravel (tymon/jwt-auth)

// Login - genera JWT token
public function login(Request $request): JsonResponse
{
    $credentials = $request->validate([
        'email' => 'required|email',
        'password' => 'required',
    ]);

    if (!$token = auth('api')->attempt($credentials)) {
        return response()->json(['error' => 'Invalid credentials'], 401);
    }

    return response()->json([
        'access_token' => $token,
        'token_type' => 'bearer',
        'expires_in' => auth('api')->factory()->getTTL() * 60,
        'user' => auth('api')->user(),
    ]);
}

// Refresh token
public function refresh(): JsonResponse
{
    return response()->json([
        'access_token' => auth('api')->refresh(),
        'token_type' => 'bearer',
    ]);
}

// Logout
public function logout(): JsonResponse
{
    auth('api')->logout();
    return response()->json(['message' => 'Logged out']);
}

Node.js (jsonwebtoken)

const jwt = require('jsonwebtoken');
const bcrypt = require('bcryptjs');

// Login
exports.login = asyncHandler(async (req, res) => {
  const { email, password } = req.body;

  const user = await User.findOne({ email }).select('+password');
  if (!user || !(await bcrypt.compare(password, user.password))) {
    res.status(401);
    throw new Error('Invalid credentials');
  }

  const token = jwt.sign({ id: user._id }, process.env.JWT_SECRET, {
    expiresIn: process.env.JWT_EXPIRE || '7d'
  });

  res.json({ token, user: { id: user._id, email: user.email, roles: user.roles } });
});