security

Security & OWASP Top 10

CRITICAL: AI models will generate insecure code by default. These rules are non-negotiable.

1. Injection Prevention (A03:2021)

NEVER use string interpolation in database queries.

// ❌ SQL INJECTION VULNERABILITY
const { data } = await supabase.rpc('search', { query: `%${userInput}%` })

// ✅ SAFE: Use parameterized queries
const { data } = await supabase
  .from('items')
  .select()
  .ilike('name', `%${userInput}%`)  // Supabase auto-escapes

2. XSS Prevention (A07:2021)

// ❌ XSS VULNERABILITY — NEVER do this
<div dangerouslySetInnerHTML={{ __html: userContent }} />

// ✅ If you MUST render HTML, sanitize first
import DOMPurify from 'isomorphic-dompurify'
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userContent) }} />

3. Authentication Boundary (A01:2021 - Broken Access Control)

EVERY Server Action and Route Handler MUST verify auth before ANY data operation:

export async function deleteItem(id: string) {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) return { error: 'Unauthorized' }

  // ALSO verify ownership — don't just check auth
  const { data: item } = await supabase
    .from('items')
    .select('user_id')
    .eq('id', id)
    .single()
  
  if (item?.user_id !== user.id) return { error: 'Forbidden' }

  await supabase.from('items').delete().eq('id', id)
}

4. Rate Limiting (A04:2021 - Insecure Design)

Sensitive endpoints MUST be rate limited:

import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(5, '60 s'), // 5 requests per minute
})

export async function POST(request: Request) {
  const ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1'
  const { success } = await ratelimit.limit(ip)
  if (!success) {
    return Response.json({ error: 'Rate limited' }, { status: 429 })
  }
  // ... handle request
}