Security Best Practices

// Authentication configuration
const authConfig = {
  // Password hashing
  password: {
    saltRounds: 12,
    minLength: 12,
    requireUppercase: true,
    requireNumbers: true,
    requireSpecial: true
  },

  // Session configuration
  session: {
    secret: process.env.SESSION_SECRET,
    maxAge: 3600000, // 1 hour
    secure: true,
    httpOnly: true,
    sameSite: 'strict'
  },

  // Rate limiting
  rateLimit: {
    window: 15 * 60 * 1000, // 15 minutes
    max: 100, // max 100 requests per window
    message: 'Too many requests, please try again later'
  }
};

// Password validation
const validatePassword = (password) => {
  const requirements = {
    length: password.length >= authConfig.password.minLength,
    uppercase: /[A-Z]/.test(password),
    numbers: /[0-9]/.test(password),
    special: /[!@#$%^&*]/.test(password)
  };

  return Object.values(requirements).every(Boolean);
};

// User authentication
const authenticateUser = async (email, password) => {
  const user = await db.users.findOne({ email });
  
  if (!user) {
    throw new Error('Invalid credentials');
  }
  
  const valid = await bcrypt.compare(password, user.passwordHash);
  
  if (!valid) {
    throw new Error('Invalid credentials');
  }
  
  return user;
};

// RBAC configuration
const rbacConfig = {
  roles: {
    admin: {
      permissions: ['read', 'write', 'delete', 'manage_users']
    },
    editor: {
      permissions: ['read', 'write']
    },
    viewer: {
      permissions: ['read']
    }
  }
};

// Permission middleware
const checkPermission = (permission) => {
  return async (req, res, next) => {
    const user = req.user;
    
    if (!user) {
      return res.status(401).json({ error: 'Unauthorized' });
    }
    
    const role = rbacConfig.roles[user.role];
    
    if (!role || !role.permissions.includes(permission)) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    
    next();
  };
};

// Apply to routes
app.get('/admin', checkPermission('manage_users'), (req, res) => {
  // Admin route handler
});

app.post('/content', checkPermission('write'), (req, res) => {
  // Content creation handler
});

// Encryption configuration
const encryptionConfig = {
  algorithm: 'aes-256-gcm',
  keyLength: 32, // 256 bits
  ivLength: 16, // 128 bits
  tagLength: 16 // 128 bits
};

// Encryption service
const encryption = {
  async encrypt(data) {
    const iv = crypto.randomBytes(encryptionConfig.ivLength);
    const key = Buffer.from(process.env.ENCRYPTION_KEY, 'hex');
    
    const cipher = crypto.createCipheriv(
      encryptionConfig.algorithm,
      key,
      iv
    );
    
    let encrypted = cipher.update(data, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    
    const tag = cipher.getAuthTag();
    
    return {
      encrypted,
      iv: iv.toString('hex'),
      tag: tag.toString('hex')
    };
  },
  
  async decrypt(data) {
    const key = Buffer.from(process.env.ENCRYPTION_KEY, 'hex');
    const iv = Buffer.from(data.iv, 'hex');
    const tag = Buffer.from(data.tag, 'hex');
    
    const decipher = crypto.createDecipheriv(
      encryptionConfig.algorithm,
      key,
      iv
    );
    
    decipher.setAuthTag(tag);
    
    let decrypted = decipher.update(data.encrypted, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    
    return decrypted;
  }
};

// Data sanitization
const sanitizeInput = (input) => {
  return DOMPurify.sanitize(input, {
    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
    ALLOWED_ATTR: ['href']
  });
};

// Security headers middleware
app.use((req, res, next) => {
  // Content Security Policy
  res.setHeader(
    'Content-Security-Policy',
    "default-src 'self'; " +
    "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
    "style-src 'self' 'unsafe-inline'; " +
    "img-src 'self' data: https:; " +
    "font-src 'self'; " +
    "connect-src 'self' https://api.example.com;"
  );
  
  // HSTS
  res.setHeader(
    'Strict-Transport-Security',
    'max-age=31536000; includeSubDomains; preload'
  );
  
  // Prevent clickjacking
  res.setHeader('X-Frame-Options', 'DENY');
  
  // XSS protection
  res.setHeader('X-XSS-Protection', '1; mode=block');
  
  // Prevent MIME type sniffing
  res.setHeader('X-Content-Type-Options', 'nosniff');
  
  // Referrer policy
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  
  // Feature policy
  res.setHeader(
    'Permissions-Policy',
    'camera=(), microphone=(), geolocation=()'
  );
  
  next();
});

// CORS configuration
const corsOptions = {
  origin: process.env.ALLOWED_ORIGINS.split(','),
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400 // 24 hours
};

app.use(cors(corsOptions));