2.6 KiB
Boundary hardening choices
Read the relevant section when implementing that boundary. Values and tools come from the product's threat model, stack, and resource budgets, not this document.
Identity and authorization
Authenticate on the server. Bind private reads and writes to the caller's allowed resources and tenant. Prefer an ownership predicate in the data operation; a separate read-check-write sequence can race. Verify cookie-authenticated mutations have appropriate CSRF/origin protections and session expiry behavior.
Payloads and credentials
Validate runtime shapes and bound request bytes, field lengths, array counts, and expensive processing. Reject invalid credentials without silent truncation. Hash passwords with the framework's supported algorithm and settings; bcrypt's 72-byte input limitation is bytes, not characters. Use the selected algorithm's documented limits and preserve long-password support when choosing the design.
Uploads
Choose an explicit extension/content allowlist and byte cap per supported format. Stop streaming at the cap. Inspect content with a suitable parser; signatures alone cannot validate the whole file. Generate storage IDs; keep the storage root isolated and non-executable, prevent traversal/symlink escapes, and bound archive expansion. Serve active content in an appropriate isolated origin or as an attachment. Apply malware scanning or re-encoding when the threat model warrants it.
User-influenced outbound requests
Prefer service allowlists. Resolve all IPv4/IPv6 addresses and validate the actual connection destination, including DNS changes. Disable redirects or repeat checks for each hop. Bound time, bytes, and egress. Trusted internal service calls use their own allowlist rather than a blanket private-network ban. See OWASP SSRF guidance.
Browser and abuse controls
Use CSP, framing rules, safe content types, CSRF protection, and rate limiting for the relevant flow. Configure limits by actor, cost, and deployment topology. Apply HSTS only to intended HTTPS domains; subdomains/preload require deliberate coverage. Do not disable required browser capabilities through a blanket Permissions-Policy.
Verification
Test relevant unauthorized and malformed cases. Audit dependencies when dependency
risk is part of the task; inspect the result before changing versions. Do not run
npm audit fix as an automatic audit step or change the user's stack by default.
Follow shared verification.