auth-security-reviewer

Auth Security Reviewer

Comprehensive security review of authentication systems.

Session Security Checklist

// ❌ INSECURE Session Configuration app.use( session({ secret: "weak-secret", // Too simple resave: true, // Unnecessary saveUninitialized: true, // Creates unnecessary sessions cookie: { secure: false, // Not HTTPS-only httpOnly: false, // Accessible via JavaScript sameSite: false, // CSRF vulnerable maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year - too long }, }) );

// ✅ SECURE Session Configuration app.use( session({ secret: process.env.SESSION_SECRET, // From environment resave: false, saveUninitialized: false, name: "sessionId", // Don't use default 'connect.sid' cookie: { secure: true, // HTTPS only httpOnly: true, // No JavaScript access sameSite: "strict", // CSRF protection maxAge: 24 * 60 * 60 * 1000, // 24 hours domain: process.env.COOKIE_DOMAIN, }, store: new RedisStore({ client: redisClient, ttl: 86400, }), }) );

JWT Security Review

// ❌ INSECURE JWT Implementation const token = jwt.sign( { userId: user.id }, "weak-secret", // Hardcoded secret { algorithm: "HS256" } // No expiration );

// Store in localStorage localStorage.setItem("token", token); // XSS vulnerable

// ✅ SECURE JWT Implementation const token = jwt.sign( { userId: user.id, role: user.role, iat: Math.floor(Date.now() / 1000), }, process.env.JWT_SECRET, // Strong secret from env { algorithm: "HS256", expiresIn: "15m", // Short-lived issuer: "myapp.com", audience: "myapp.com", } );

// Store in httpOnly cookie res.cookie("accessToken", token, { httpOnly: true, secure: true, sameSite: "strict", maxAge: 15 * 60 * 1000, });

// Refresh token with longer expiry const refreshToken = jwt.sign( { userId: user.id, type: "refresh" }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: "7d" } );

// Store refresh token in database await storeRefreshToken(user.id, refreshToken);

CSRF Protection

// Using csurf middleware import csrf from "csurf";

const csrfProtection = csrf({ cookie: true });

// Apply to state-changing routes app.post("/api/transfer", csrfProtection, async (req, res) => { // Protected from CSRF await processTransfer(req.body); res.json({ success: true }); });

// Provide CSRF token to frontend app.get("/api/csrf-token", csrfProtection, (req, res) => { res.json({ csrfToken: req.csrfToken() }); });

// Frontend usage const csrfToken = await fetch("/api/csrf-token").then((r) => r.json());

await fetch("/api/transfer", { method: "POST", headers: { "Content-Type": "application/json", "X-CSRF-Token": csrfToken.csrfToken, }, body: JSON.stringify({ amount: 100 }), });

Password Security

// ❌ INSECURE Password Handling const password = req.body.password; const hash = crypto.createHash("md5").update(password).digest("hex"); // MD5 is broken await db.user.create({ password: hash });

// ✅ SECURE Password Handling import bcrypt from "bcrypt";

// Hashing const saltRounds = 12; // Adjust based on security requirements const hash = await bcrypt.hash(password, saltRounds); await db.user.create({ passwordHash: hash });

// Verification const isValid = await bcrypt.compare(password, user.passwordHash);

// Password requirements function validatePassword(password: string): boolean { return ( password.length >= 12 && /[A-Z]/.test(password) && // Uppercase /[a-z]/.test(password) && // Lowercase /[0-9]/.test(password) && // Number /[^A-Za-z0-9]/.test(password) // Special char ); }

// Check against breached passwords import { pwnedPassword } from "hibp";

const breachCount = await pwnedPassword(password); if (breachCount > 0) { throw new Error("This password has been found in data breaches"); }

Multi-Factor Authentication

// TOTP-based MFA import speakeasy from "speakeasy"; import qrcode from "qrcode";

// Generate secret const secret = speakeasy.generateSecret({ name: MyApp (${user.email}), issuer: "MyApp", });

// Store secret await db.user.update({ where: { id: user.id }, data: { mfaSecret: secret.base32, mfaEnabled: false, // Not enabled until verified }, });

// Generate QR code const qrCodeUrl = await qrcode.toDataURL(secret.otpauth_url);

// Verify TOTP token function verifyMFA(token: string, secret: string): boolean { return speakeasy.totp.verify({ secret, encoding: "base32", token, window: 2, // Allow 2 time steps before/after }); }

// Backup codes function generateBackupCodes(): string[] { return Array.from({ length: 10 }, () => crypto.randomBytes(4).toString("hex").toUpperCase() ); }

Authorization Vulnerabilities

// ❌ INSECURE: Missing authorization check app.get("/api/users/:id/profile", async (req, res) => { const profile = await db.user.findUnique({ where: { id: req.params.id }, }); res.json(profile); // Anyone can access any profile! });

// ✅ SECURE: Proper authorization app.get("/api/users/:id/profile", authenticate, async (req, res) => { // Check if user can access this profile if (req.user.id !== req.params.id && req.user.role !== "ADMIN") { return res.status(403).json({ error: "Forbidden" }); }

const profile = await db.user.findUnique({ where: { id: req.params.id }, }); res.json(profile); });

// ❌ INSECURE: IDOR vulnerability app.delete("/api/orders/:id", async (req, res) => { await db.order.delete({ where: { id: req.params.id } }); res.json({ success: true }); });

// ✅ SECURE: Verify ownership app.delete("/api/orders/:id", authenticate, async (req, res) => { const order = await db.order.findUnique({ where: { id: req.params.id }, });

if (!order) { return res.status(404).json({ error: "Not found" }); }

if (order.userId !== req.user.id) { return res.status(403).json({ error: "Forbidden" }); }

await db.order.delete({ where: { id: req.params.id } }); res.json({ success: true }); });

Session Fixation Prevention

// ❌ INSECURE: Session not regenerated on login app.post("/login", async (req, res) => { const user = await authenticate(req.body); req.session.userId = user.id; res.json({ success: true }); });

// ✅ SECURE: Regenerate session on login app.post("/login", async (req, res) => { const user = await authenticate(req.body);

// Regenerate session to prevent fixation req.session.regenerate((err) => { if (err) return res.status(500).json({ error: "Server error" });

req.session.userId = user.id;
res.json({ success: true });

}); });

// Also regenerate on privilege escalation app.post("/admin/elevate", async (req, res) => { // Verify admin credentials await verifyAdminPassword(req.body.password);

// Regenerate session req.session.regenerate((err) => { if (err) return res.status(500).json({ error: "Server error" });

req.session.isAdmin = true;
res.json({ success: true });

}); });

Rate Limiting on Auth Endpoints

import rateLimit from "express-rate-limit";

// Strict rate limit for login const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 5, // 5 attempts message: "Too many login attempts, please try again later", standardHeaders: true, legacyHeaders: false, // Use IP + username for more granular limiting keyGenerator: (req) => ${req.ip}-${req.body.email}, });

app.post("/api/login", loginLimiter, async (req, res) => { // Login logic });

// Even stricter for password reset const resetLimiter = rateLimit({ windowMs: 60 * 60 * 1000, // 1 hour max: 3, message: "Too many password reset attempts", });

app.post("/api/password-reset", resetLimiter, async (req, res) => { // Password reset logic });

Security Testing

// tests/auth-security.test.ts describe("Auth Security", () => { describe("Session Security", () => { it("should set httpOnly cookie", async () => { const response = await request(app) .post("/api/login") .send({ email: "test@example.com", password: "password123" });

  const cookie = response.headers["set-cookie"][0];
  expect(cookie).toContain("HttpOnly");
  expect(cookie).toContain("Secure");
  expect(cookie).toContain("SameSite=Strict");
});

it("should regenerate session on login", async () => {
  const agent = request.agent(app);

  // Get initial session
  await agent.get("/");
  const initialCookie = agent.jar.getCookie("sessionId");

  // Login
  await agent.post("/api/login").send({
    email: "test@example.com",
    password: "password123",
  });

  const loginCookie = agent.jar.getCookie("sessionId");

  // Session ID should change
  expect(loginCookie.value).not.toBe(initialCookie.value);
});

});

describe("CSRF Protection", () => { it("should reject requests without CSRF token", async () => { await request(app) .post("/api/transfer") .send({ amount: 100 }) .expect(403); });

it("should accept requests with valid CSRF token", async () => {
  const { csrfToken } = await request(app)
    .get("/api/csrf-token")
    .then((r) => r.body);

  await request(app)
    .post("/api/transfer")
    .set("X-CSRF-Token", csrfToken)
    .send({ amount: 100 })
    .expect(200);
});

});

describe("Authorization", () => { it("should prevent IDOR attacks", async () => { const user1 = await createUser(); const user2 = await createUser();

  const token1 = generateToken(user1);

  // Try to access user2's profile with user1's token
  await request(app)
    .get(`/api/users/${user2.id}/profile`)
    .set("Authorization", `Bearer ${token1}`)
    .expect(403);
});

}); });

Best Practices

Regenerate sessions: On login and privilege changes
Short-lived tokens: 15min access, 7-day refresh
CSRF protection: All state-changing operations
Rate limiting: Prevent brute force
Secure cookies: HttpOnly, Secure, SameSite
MFA: For sensitive operations
Audit logs: Track authentication events

Output Checklist

Session configuration reviewed
JWT implementation secured
CSRF protection enabled
Password hashing with bcrypt
MFA implementation (if required)
Authorization checks on all endpoints
Session fixation prevention
Rate limiting on auth endpoints
Security tests written
Audit logging configured

auth-security-reviewer

Safety Notice

Copy this and send it to your AI assistant to learn

Source Transparency

Related Skills

accessibility-auditor

data-integrity-auditor

api-security-hardener

security-pr-checklist-skill