API Security: Protecting Your Endpoints

// ❌ VULNERABLE - No authorization check
app.get('/api/orders/:orderId', authenticateToken, async (req, res) => {
    const order = await db.orders.findById(req.params.orderId);
    res.json(order); // Anyone can view any order!
});

// ✅ SECURE - Proper authorization
app.get('/api/orders/:orderId', authenticateToken, async (req, res) => {
    const order = await db.orders.findById(req.params.orderId);
    
    if (!order) {
        return res.status(404).json({ error: 'Order not found' });
    }
    
    // Check ownership or admin role
    if (order.userId !== req.user.id && req.user.role !== 'admin') {
        return res.status(403).json({ error: 'Access denied' });
    }
    
    res.json(order);
});

// Even better: Use middleware for reusability
const authorizeResource = (resourceType) => async (req, res, next) => {
    const resource = await db[resourceType].findById(req.params.id);
    
    if (!resource) {
        return res.status(404).json({ error: 'Not found' });
    }
    
    const isOwner = resource.userId === req.user.id;
    const isAdmin = req.user.role === 'admin';
    
    if (!isOwner && !isAdmin) {
        return res.status(403).json({ error: 'Access denied' });
    }
    
    req.resource = resource;
    next();
};

app.get('/api/orders/:id', 
    authenticateToken,
    authorizeResource('orders'),
    (req, res) => res.json(req.resource)
);

// Define permissions per role
const PERMISSIONS = {
    admin: ['read:users', 'write:users', 'delete:users', 'read:orders', 'write:orders', 'read:analytics'],
    manager: ['read:users', 'read:orders', 'write:orders', 'read:analytics'],
    user: ['read:profile', 'write:profile', 'read:orders', 'write:orders'],
    guest: ['read:products']
};

// Permission checking middleware
const requirePermission = (...requiredPermissions) => {
    return (req, res, next) => {
        const userRole = req.user.role;
        const userPermissions = PERMISSIONS[userRole] || [];
        
        const hasPermission = requiredPermissions.every(
            perm => userPermissions.includes(perm)
        );
        
        if (!hasPermission) {
            return res.status(403).json({
                error: 'Insufficient permissions',
                required: requiredPermissions
            });
        }
        
        next();
    };
};

// Usage in routes
app.get('/api/users', 
    authenticateToken,
    requirePermission('read:users'),
    usersController.list
);

app.delete('/api/users/:id',
    authenticateToken,
    requirePermission('delete:users'),
    usersController.delete
);

app.get('/api/analytics/dashboard',
    authenticateToken,
    requirePermission('read:analytics'),
    analyticsController.dashboard
);

const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');
const Redis = require('ioredis');

const redis = new Redis(process.env.REDIS_URL);

// Global rate limiter
const globalLimiter = rateLimit({
    windowMs: 60 * 1000, // 1 minute
    max: 1000,           // 1000 requests per minute globally
    standardHeaders: true,
    legacyHeaders: false,
    store: new RedisStore({
        sendCommand: (...args) => redis.call(...args),
    }),
    message: { error: 'Too many requests, please try again later' }
});

// Per-user rate limiter
const userLimiter = rateLimit({
    windowMs: 60 * 1000,
    max: 100,           // 100 requests per user per minute
    keyGenerator: (req) => req.user?.id || req.ip,
    store: new RedisStore({
        sendCommand: (...args) => redis.call(...args),
        prefix: 'rl:user:'
    }),
    handler: (req, res) => {
        res.status(429).json({
            error: 'Rate limit exceeded',
            retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
        });
    }
});

// Strict limiter for sensitive endpoints
const authLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 5,                    // 5 attempts per 15 minutes
    keyGenerator: (req) => req.ip + ':' + req.body.email,
    store: new RedisStore({
        sendCommand: (...args) => redis.call(...args),
        prefix: 'rl:auth:'
    }),
    skipSuccessfulRequests: true, // Don't count successful logins
    message: { 
        error: 'Too many login attempts',
        retryAfter: 900 // 15 minutes in seconds
    }
});

// Apply limiters
app.use(globalLimiter);
app.use('/api', userLimiter);
app.post('/api/auth/login', authLimiter, authController.login);
app.post('/api/auth/register', authLimiter, authController.register);
app.post('/api/auth/forgot-password', authLimiter, authController.forgotPassword);

const Joi = require('joi');

// Define validation schemas
const schemas = {
    createUser: Joi.object({
        email: Joi.string()
            .email()
            .required()
            .lowercase()
            .trim()
            .max(255),
        
        password: Joi.string()
            .required()
            .min(8)
            .max(128)
            .pattern(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])/)
            .messages({
                'string.pattern.base': 'Password must include uppercase, lowercase, number, and special character'
            }),
        
        name: Joi.string()
            .required()
            .trim()
            .min(2)
            .max(100)
            .pattern(/^[a-zA-Z\s'-]+$/)
            .messages({
                'string.pattern.base': 'Name can only contain letters, spaces, hyphens, and apostrophes'
            }),
        
        age: Joi.number()
            .integer()
            .min(13)
            .max(120)
            .optional(),
        
        role: Joi.string()
            .valid('user', 'editor')  // Never allow 'admin' from client!
            .default('user')
    }),
    
    updateProfile: Joi.object({
        name: Joi.string().trim().min(2).max(100),
        bio: Joi.string().max(500).allow(''),
        avatar: Joi.string().uri({ scheme: ['https'] })
    }).min(1), // At least one field required
    
    queryParams: Joi.object({
        page: Joi.number().integer().min(1).default(1),
        limit: Joi.number().integer().min(1).max(100).default(20),
        sort: Joi.string().valid('createdAt', 'name', 'email').default('createdAt'),
        order: Joi.string().valid('asc', 'desc').default('desc'),
        search: Joi.string().max(100).trim()
    })
};

// Validation middleware
const validate = (schemaName, source = 'body') => {
    return (req, res, next) => {
        const schema = schemas[schemaName];
        const data = req[source];
        
        const { error, value } = schema.validate(data, {
            abortEarly: false,  // Return all errors
            stripUnknown: true  // Remove unknown fields
        });
        
        if (error) {
            const errors = error.details.map(d => ({
                field: d.path.join('.'),
                message: d.message
            }));
            
            return res.status(400).json({ 
                error: 'Validation failed',
                details: errors 
            });
        }
        
        req[source] = value; // Use sanitized data
        next();
    };
};

// Usage
app.post('/api/users', 
    validate('createUser'), 
    userController.create
);

app.patch('/api/profile',
    authenticateToken,
    validate('updateProfile'),
    userController.updateProfile
);

app.get('/api/users',
    authenticateToken,
    validate('queryParams', 'query'),
    userController.list
);

// ❌ VULNERABLE - String concatenation
const query = `SELECT * FROM users WHERE email = '${email}'`;
// Attacker input: ' OR '1'='1' --
// Result: SELECT * FROM users WHERE email = '' OR '1'='1' --'

// ✅ SECURE - Parameterized queries
// With mysql2
const [rows] = await connection.execute(
    'SELECT * FROM users WHERE email = ? AND status = ?',
    [email, 'active']
);

// With Sequelize ORM
const user = await User.findOne({
    where: {
        email: email,
        status: 'active'
    }
});

// With Prisma
const user = await prisma.user.findUnique({
    where: { email: email }
});

// With Knex.js
const user = await knex('users')
    .where({ email, status: 'active' })
    .first();

// MongoDB with Mongoose - still validate input!
const user = await User.findOne({ 
    email: { $eq: email }  // Use $eq to prevent operator injection
});

// ❌ VULNERABLE MongoDB
const user = await User.findOne({ email: req.body.email });
// Attacker sends: { "email": { "$ne": "" } }
// Returns first user with non-empty email!

// ✅ SECURE MongoDB - validate type
if (typeof req.body.email !== 'string') {
    return res.status(400).json({ error: 'Invalid email' });
}
const user = await User.findOne({ email: req.body.email });

const helmet = require('helmet');

// Apply security headers
app.use(helmet({
    // Strict Transport Security - force HTTPS
    hsts: {
        maxAge: 31536000,       // 1 year
        includeSubDomains: true,
        preload: true
    },
    
    // Prevent clickjacking
    frameguard: { action: 'deny' },
    
    // XSS protection
    xssFilter: true,
    
    // Prevent MIME sniffing
    noSniff: true,
    
    // Content Security Policy
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'"],
            styleSrc: ["'self'", "'unsafe-inline'"],
            imgSrc: ["'self'", "data:", "https:"],
            connectSrc: ["'self'", "https://api.yourdomain.com"],
            fontSrc: ["'self'"],
            objectSrc: ["'none'"],
            mediaSrc: ["'self'"],
            frameSrc: ["'none'"]
        }
    }
}));

// Force HTTPS redirect (for apps behind load balancer)
app.use((req, res, next) => {
    if (req.headers['x-forwarded-proto'] !== 'https' && 
        process.env.NODE_ENV === 'production') {
        return res.redirect(301, `https://${req.hostname}${req.url}`);
    }
    next();
});

// CORS configuration
const cors = require('cors');
app.use(cors({
    origin: ['https://yourapp.com', 'https://admin.yourapp.com'],
    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
    allowedHeaders: ['Content-Type', 'Authorization'],
    credentials: true,
    maxAge: 86400 // 24 hours
}));