This document outlines the comprehensive security measures implemented in the Art Marketplace backend application to protect against common web vulnerabilities and ensure data integrity.

• Content Security Policy (CSP): Prevents XSS attacks by controlling resource loading
• HSTS: Forces HTTPS connections in production
• X-Frame-Options: Prevents clickjacking attacks
• X-Content-Type-Options: Prevents MIME type sniffing
• X-XSS-Protection: Additional XSS protection for older browsers
• Referrer Policy: Controls referrer information leakage

• Authentication Endpoints: 5 requests per 15 minutes
• File Uploads: 10 uploads per 15 minutes
• General API: 100 requests per 15 minutes
• IP-based Limiting: Prevents abuse from single sources
• User-based Limiting: Additional protection for authenticated users

• Restricted Origins: Only allows specified frontend domains
• Secure Headers: Limits exposed headers and methods
• Credentials Support: Enables secure cross-origin requests
• Preflight Handling: Proper OPTIONS request handling

• Input Sanitization: Removes XSS vectors from all inputs
• Data Validation: Comprehensive validation using express-validator
• SQL Injection Prevention: MongoDB with parameterized queries
• File Upload Security: Strict file type and size validation

• Secret Management: All sensitive data in environment variables
• Configuration Validation: Automatic validation of required settings
• Production Checks: Enforces security requirements in production
• Secure Defaults: Safe fallback values for development

# Required for production
NODE_ENV=production
MONGO_URI=mongodb+srv://...
JWT_SECRET=your-64-character-secret
FRONTEND_URL=https://yourdomain.com

# Security configuration
CORS_ORIGINS=https://yourdomain.com,https://www.yourdomain.com
RATE_LIMIT_MAX_REQUESTS=100
AUTH_RATE_LIMIT_MAX=5
UPLOAD_RATE_LIMIT_MAX=10
MAX_FILE_SIZE=5242880

// Additional security headers set
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubDomains
Permissions-Policy: geolocation=(), microphone=(), camera=()

• ✅ Input sanitization middleware
• ✅ Content Security Policy
• ✅ XSS protection headers
• ✅ Data validation and escaping

• ✅ CORS origin validation
• ✅ SameSite cookie attributes
• ✅ Origin verification

• ✅ MongoDB with parameterized queries
• ✅ Input validation and sanitization
• ✅ No direct SQL queries

• ✅ File type validation
• ✅ File size limits
• ✅ Filename sanitization
• ✅ Path traversal prevention

• ✅ Rate limiting on auth endpoints
• ✅ Account lockout mechanisms
• ✅ Secure password requirements

• ✅ Error message sanitization
• ✅ Stack trace hiding in production
• ✅ Secure error handling

• All environment variables configured
• Strong JWT secrets generated
• CORS origins properly set
• Rate limits configured
• File upload limits set

• HTTPS enabled
• Strong secrets (32+ characters)
• Environment validation passing
• Security headers verified
• Rate limiting active
• File upload security enabled

• Security logs enabled
• Rate limit monitoring
• Error tracking configured
• Performance monitoring active

# Test rate limiting
curl -X POST http://localhost:5000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"test"}'

# Test CORS
curl -H "Origin: http://malicious.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: X-Requested-With" \
  -X OPTIONS http://localhost:5000/api/auth/login

# Test file upload security
curl -X POST http://localhost:5000/api/artworks/create \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -F "[email protected]" \
  -F "title=Test" \
  -F "price=100"

# Run security tests
npm run test:security

# Run validation tests
npm run test:validation

# Run rate limiting tests
npm run test:ratelimit

• Rate limit violations
• Authentication failures
• File upload attempts
• Validation errors
• CORS violations

• High rate of failed logins
• Unusual file upload patterns
• API abuse detection
• Security header violations

• Always validate and sanitize inputs
• Use parameterized queries
• Implement proper error handling
• Log security events
• Regular dependency updates

• Use HTTPS everywhere
• Implement proper firewall rules
• Regular security audits
• Monitor access logs
• Backup security

• Regular secret rotation
• Access control reviews
• Security training for team
• Incident response plan
• Regular penetration testing

1. Immediate Response

   • Isolate affected systems
   • Preserve evidence
   • Notify security team

2. Investigation

   • Analyze logs and events
   • Identify attack vector
   • Assess damage scope

3. Recovery

   • Patch vulnerabilities
   • Restore from backups
   • Update security measures

4. Post-Incident

   • Document lessons learned
   • Update security procedures
   • Conduct security review

• Security Team: [email protected]
• Emergency: +1-XXX-XXX-XXXX
• Bug Reports: [email protected]

• OWASP Top 10
• Node.js Security Best Practices
• Express Security Best Practices
• MongoDB Security Checklist

Last Updated: December 2024
Version: 1.0
Maintainer: Security Team