NestJS Security Standards

Authentication

• Strategies: Use @nestjs/passport with passport-jwt.
• JWT Hardening:

- Algorithm: Enforce algorithms: ['RS256'] (preferred) or ['HS256']. Reject none. - Claims: Validate iss (Issuer) and aud (Audience). - Secrets: High entropy (> 256-bit) for HS256.

• State: Stateless. Short access tokens (15m), Long httponly refresh tokens (7d).
• MFA: Require 2FA for sensitive access (admin panels).

Authorization (RBAC)

• Strategy: Deny by default.

- Implementation: Bind AuthGuard globally (APP_GUARD). - Bypass: Create a @Public() decorator and allow access if present in the Guard.

• Metadata: Use Reflector.createDecorator<string[]>().
• Guards: Use Reflector to merge Method/Class roles (getAllAndOverride).

Cryptography & Hashing

• Hashing:

- Algorithm: Use Argon2id (argon2) instead of Bcrypt (vulnerable to GPU/FPGA cracking). - Implementation: await argon2.hash(password).

• Encryption (At Rest):

- Algorithm: Use AES-256-GCM (Authenticated Encryption). - Keys: Never hardcode. Rotate keys using a KMS (Key Management Service). - Native: Use Node.js crypto.createCipheriv.

CSRF (Cross-Site Request Forgery)

• Context: Mandatory if using Cookie-based sessions or Cookie-based JWTs.
• Mitigation:

- Synchronizer Token: Use csurf via @nest-middlewares/csurf or similar wrapper. - State: Token must be cryptographically strong and verified on every state-changing request (POST/PUT/DELETE).

• Note: If using strictly Authorization: Bearer headers (localStorage), CSRF is less critical but SameSite: Strict cookies are still recommended for defense-in-depth.

Hardening

1. Helmet: Mandatory. app.use(helmet()).

- HSTS: Enable Strict-Transport-Security with preload. - CSP: Configure Content Security Policy specifically if serving any UI.

1. Permissions-Policy: Restrict browser permissions via helmet.permissionsPolicy().
2. CORS: Explicit origins only. No *.
3. Throttling:

- Distributed: Do not use in-memory rate limiting in production. Use @nestjs/throttler with Redis storage (throttler-storage-redis) to sync limits across instances.

Audit Logging

• Requirement: Track critical mutations (Who, What, When).
• Pattern: Implement an AuditInterceptor that logs POST/PUT/DELETE actions to a secure, immutable log store (separate from app logs).

Secrets & Config

• CI/CD: Run npm audit or pnpm audit --prod in pipelines.
• Runtime: Avoid .env files in production runtime. Inject secrets via environment variables from a vault (AWS Secret Manager / HashiCorp Vault) into the container environment.

Data Sanitization

• Transform: Use ClassSerializerInterceptor + @Exclude() globally or per-controller to strip sensitive fields (passwords) from responses.
• Validation: ValidationPipe({ whitelist: true }) prevents mass assignment attacks by stripping unknown properties from payloads.

Improper Assets Management

• Shadow APIs: Audit routes regularly.
• Deprecation: Disable Swagger/OpenAPI endpoints (/api, /docs) in production.

Server-Side Request Forgery (SSRF)

• Validation: Validate/Allowlist domains for all outgoing HTTP requests (HttpService).
• Network: Restrict egress traffic (e.g., block AWS metadata 169.254.169.254) via infrastructure/firewall.

Injection Prevention

• SQLi: Prefer ORM/ODM methods. Avoid raw queries (query()) with string concatenation. Use parameterized queries if raw SQL is strictly necessary.
• XSS: Input validation is not enough. Sanitize HTML input (e.g., dompurify) before storage or output.