security

Security Best Practices

Overview

Area	Priority
Authentication	Critical
Authorization	Critical
Input Validation	Critical
Data Protection	High
API Security	High

---

Authentication

Password Handling

// ✅ Use bcrypt or argon2 for password hashing
import bcrypt from 'bcrypt'

const SALT_ROUNDS = 12

async function hashPassword(password: string): Promise<string> {
  return bcrypt.hash(password, SALT_ROUNDS)
}

async function verifyPassword(password: string, hash: string): Promise<boolean> {
  return bcrypt.compare(password, hash)
}

// ❌ Never store plain text passwords
// ❌ Never use MD5 or SHA1 for passwords
// ❌ Never log passwords

JWT Tokens

import jwt from 'jsonwebtoken'

// ✅ Short-lived access tokens
const ACCESS_TOKEN_EXPIRY = '15m'

// ✅ Longer refresh tokens (stored securely)
const REFRESH_TOKEN_EXPIRY = '7d'

function generateAccessToken(userId: string): string {
  return jwt.sign(
    { sub: userId, type: 'access' },
    process.env.JWT_SECRET!,
    { expiresIn: ACCESS_TOKEN_EXPIRY }
  )
}

// ✅ Always verify tokens
function verifyToken(token: string): JwtPayload {
  return jwt.verify(token, process.env.JWT_SECRET!) as JwtPayload
}

Session Security

// ✅ Secure cookie settings
const sessionConfig = {
  httpOnly: true,    // Prevents XSS access to cookie
  secure: true,      // HTTPS only (in production)
  sameSite: 'strict', // Prevents CSRF
  maxAge: 24 * 60 * 60 * 1000, // 24 hours
}

---

Input Validation

Validate All Input

import { z } from 'zod'

// ✅ Define strict schemas
const userSchema = z.object({
  email: z.string().email().max(255),
  password: z.string().min(8).max(100),
  name: z.string().min(1).max(100).regex(/^[a-zA-Z\s]+$/),
})

// ✅ Validate before processing
function createUser(input: unknown) {
  const validated = userSchema.parse(input)
  // Safe to use validated data
}

Prevent SQL Injection