Enhanced Security Module

.env.example

@@ -33,3 +33,11 @@ PUSHER_APP_ID=your_app_id
 PUSHER_KEY=your_key
 PUSHER_SECRET=your_secret
 PUSHER_CLUSTER=your_cluster
+
+# --- Security Configuration ---
+ALLOWED_ORIGINS=http://localhost:3000,https://yourapp.com
+RATE_LIMIT_POINTS=100
+RATE_LIMIT_DURATION=60
+BODY_LIMIT=1mb
+TRUST_PROXY=true
+CSP_DEFAULT_SRC='self'

README.md

@@ -547,3 +547,36 @@ For technical support or questions:
 - [TypeORM Documentation](https://typeorm.io/)
 - [Stellar SDK](https://stellar.github.io/js-stellar-sdk/)
 - [OpenAPI Specification](https://swagger.io/specification/)
+
+## 🔒 Security
+
+StarShop Backend enforces robust security policies by default. These can be customized via environment variables:
+
+- **HTTP Security Headers**: All responses include standard headers (HSTS, X-Frame-Options, XSS Protection, NoSniff, CSP) via Helmet.
+- **CORS Policy**: Origins are restricted using an allowlist from `ALLOWED_ORIGINS`.
+- **Rate Limiting**: Requests are throttled globally using `@nestjs/throttler`. Configure limits with `RATE_LIMIT_POINTS` and `RATE_LIMIT_DURATION`.
+- **Validation**: All payloads are validated and sanitized globally. Unknown fields are stripped and invalid payloads are rejected.
+- **Body Size Limits**: Request payload size is limited via `BODY_LIMIT` (default: 1mb). Oversized requests return HTTP 413.
+- **Trust Proxy**: Enable with `TRUST_PROXY=true` if running behind a load balancer or reverse proxy.
+- **Content Security Policy (CSP)**: Defaults to `'self'`, configurable via `CSP_DEFAULT_SRC`.
+
+### Example Security Environment Variables
+
+```env
+ALLOWED_ORIGINS=http://localhost:3000,https://yourapp.com
+RATE_LIMIT_POINTS=100
+RATE_LIMIT_DURATION=60
+BODY_LIMIT=1mb
+TRUST_PROXY=true
+CSP_DEFAULT_SRC='self'
+```
+
+### Acceptance Criteria
+- All responses include Helmet headers (HSTS in production)
+- CORS allowlist enforced from env; requests from disallowed origins are rejected
+- Global validation strips unknown fields and rejects invalid payloads
+- Rate limiting returns 429 when limits are exceeded; limits configurable by env
+- Body size limits enforced; oversized payloads return 413
+- CI passes and app boots with `npm run start:dev` and in production mode with security enabled
+
+See `src/security/` for implementation details and further customization.

package.json

@@ -47,6 +47,7 @@
     "@nestjs/platform-express": "^11.1.0",
     "@nestjs/schedule": "^6.0.0",
     "@nestjs/swagger": "^11.2.0",
+    "@nestjs/throttler": "^6.4.0",
     "@nestjs/typeorm": "^11.0.0",
     "@supabase/supabase-js": "^2.46.1",
     "@trustless-work/escrow": "^2.0.2",
@@ -62,6 +63,7 @@
     "express-async-handler": "^1.2.0",
     "express-rate-limit": "^7.5.0",
     "express-validator": "^7.2.0",
+    "helmet": "^8.1.0",
     "jsonwebtoken": "^9.0.2",
     "multer": "^1.4.5-lts.2",
     "multer-s3": "^3.0.1",

src/app.module.ts

@@ -21,6 +21,8 @@ import { SupabaseModule } from './modules/supabase/supabase.module';
 import { EscrowModule } from './modules/escrow/escrow.module';
 import { AppCacheModule } from './cache/cache.module';
 import { StoresModule } from './modules/stores/stores.module';
+import { SecurityModule } from './security/security.module';
+import { ThrottlerGuard } from '@nestjs/throttler';
 
 // Entities
 import { User } from './modules/users/entities/user.entity';
@@ -103,9 +105,16 @@ import { EscrowsModule } from './modules/escrows/escrows.module';
     OffersModule,
     EscrowModule,
     SupabaseModule,
-  EscrowModule,
+    EscrowModule,
     StoresModule,
     EscrowsModule,
+    SecurityModule,
+  ],
+  providers: [
+    {
+      provide: 'APP_GUARD',
+      useClass: ThrottlerGuard,
+    },
   ],
 })
 export class AppModule { }

src/main.ts

@@ -6,24 +6,72 @@ import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { BuyerRequestSchedulerService } from './modules/buyer-requests/services/buyer-request-scheduler.service';
 import { ResponseInterceptor } from './common/interceptors/response.interceptor';
 import { HttpExceptionFilter } from './common/filters/http-exception.filter';
+import { ConfigService } from '@nestjs/config';
+import helmet from 'helmet';
+import * as bodyParser from 'body-parser';
+import { ThrottlerGuard } from '@nestjs/throttler';
 
 async function bootstrap(): Promise<void> {
   const app = await NestFactory.create(AppModule);
+  const configService = app.get(ConfigService);
 
   // Middleware to track request start time for latency
   app.use((req, res, next) => {
     req._startTime = Date.now();
     next();
   });
 
-  // Enable CORS
-  app.enableCors();
+  // Enable CORS with allowlist from config
+  const allowedOrigins = configService.get<string[]>('security.allowedOrigins', ['http://localhost:3000']);
+  app.enableCors({
+    origin: (origin, callback) => {
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+      } else {
+        callback(new Error('Not allowed by CORS'));
+      }
+    },
+    credentials: true,
+  });
 
   // Global validation pipe
   app.useGlobalPipes(
     new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true })
   );
 
+  // Set body size limits
+  app.use(bodyParser.json({ limit: configService.get<string>('security.bodyLimit', '1mb') }));
+  app.use(bodyParser.urlencoded({ extended: true, limit: configService.get<string>('security.bodyLimit', '1mb') }));
+
+  // Trust proxy if enabled
+  if (configService.get<boolean>('security.trustProxy', false)) {
+    const expressApp = app.getHttpAdapter().getInstance();
+    if (expressApp && typeof expressApp.set === 'function') {
+      expressApp.set('trust proxy', 1);
+    }
+  }
+
+  // Helmet security headers
+  app.use(
+    helmet({
+      contentSecurityPolicy: {
+        useDefaults: true,
+        directives: {
+          defaultSrc: [configService.get<string>('security.cspDefaultSrc', "'self'")],
+        },
+      },
+      crossOriginEmbedderPolicy: true,
+      crossOriginResourcePolicy: { policy: 'same-origin' },
+      frameguard: { action: 'deny' },
+      hsts: process.env.NODE_ENV === 'production' ? undefined : false,
+      noSniff: true,
+      xssFilter: true,
+    })
+  );
+
+  // Global rate limiting guard
+  app.useGlobalGuards(new ThrottlerGuard());
+
   // Global response interceptor
   app.useGlobalInterceptors(new ResponseInterceptor());
 

src/security/security.config.ts

@@ -0,0 +1,10 @@
+import { registerAs } from '@nestjs/config';
+
+export default registerAs('security', () => ({
+  allowedOrigins: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'],
+  rateLimitPoints: parseInt(process.env.RATE_LIMIT_POINTS || '100', 10),
+  rateLimitDuration: parseInt(process.env.RATE_LIMIT_DURATION || '60', 10),
+  trustProxy: process.env.TRUST_PROXY === 'true',
+  bodyLimit: process.env.BODY_LIMIT || '1mb',
+  cspDefaultSrc: process.env.CSP_DEFAULT_SRC || "'self'",
+}));

src/security/security.module.ts

@@ -0,0 +1,21 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import securityConfig from './security.config';
+import { ThrottlerModule } from '@nestjs/throttler';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({
+      isGlobal: true,
+      load: [securityConfig],
+    }),
+    ThrottlerModule.forRootAsync({
+      useFactory: (config) => ({
+        ttl: config.get('security.rateLimitDuration'),
+        limit: config.get('security.rateLimitPoints'),
+      }),
+      inject: [ConfigModule],
+    }),
+  ],
+})
+export class SecurityModule {}