Applying OWASP Security

Quick Start

// lib/security/validation.ts
import { z } from "zod";
import DOMPurify from "isomorphic-dompurify";

// Input validation
export const userSchema = z.object({
  email: z.string().email().max(254),
  password: z.string().min(12).max(128),
  name: z.string().min(2).max(100).regex(/^[\p{L}\s'-]+$/u),
});

// HTML sanitization
export const sanitizeHtml = (dirty: string) =>
  DOMPurify.sanitize(dirty, { ALLOWED_TAGS: ["b", "i", "em", "strong", "a", "p"] });

Features

Common Patterns

Parameterized Queries (SQL Injection Prevention)

// BAD - SQL injection vulnerable
const result = await db.$queryRawUnsafe(`SELECT * FROM users WHERE id = '${userId}'`);

// GOOD - Parameterized query
const result = await db.user.findUnique({ where: { id: userId } });
const result = await db.$queryRaw`SELECT * FROM users WHERE id = ${userId}`;

CSRF Protection Middleware

import crypto from "crypto";

export function csrfProtection(req: Request, res: Response, next: NextFunction) {
  if (["GET", "HEAD", "OPTIONS"].includes(req.method)) return next();

  const cookieToken = req.cookies["csrf_token"];
  const headerToken = req.headers["x-csrf-token"];

  if (!cookieToken || !headerToken || cookieToken !== headerToken) {
    return res.status(403).json({ error: "CSRF validation failed" });
  }
  next();
}

Security Headers Configuration

import helmet from "helmet";

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'strict-dynamic'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      frameSrc: ["'none'"],
      objectSrc: ["'none'"],
    },
  },
  strictTransportSecurity: { maxAge: 31536000, includeSubDomains: true, preload: true },
  frameguard: { action: "deny" },
}));

Password Security

import bcrypt from "bcrypt";

const SALT_ROUNDS = 12;

export async function hashPassword(password: string): Promise<string> {
  return bcrypt.hash(password, SALT_ROUNDS);
}

export async function verifyPassword(password: string, hash: string): Promise<boolean> {
  return bcrypt.compare(password, hash);
}

export function validatePasswordStrength(password: string): string[] {
  const errors: string[] = [];
  if (password.length < 12) errors.push("Must be at least 12 characters");
  if (!/[a-z]/.test(password)) errors.push("Must contain lowercase");
  if (!/[A-Z]/.test(password)) errors.push("Must contain uppercase");
  if (!/\d/.test(password)) errors.push("Must contain digit");
  if (!/[!@#$%^&*]/.test(password)) errors.push("Must contain special character");
  return errors;
}

Best Practices

References

• OWASP Top 10
• OWASP Cheat Sheet Series
• OWASP Testing Guide
• OWASP ASVS