51 lines
2.6 KiB
Markdown
51 lines
2.6 KiB
Markdown
# Boundary hardening choices
|
|
|
|
Read the relevant section when implementing that boundary. Values and tools come
|
|
from the product's threat model, stack, and resource budgets, not this document.
|
|
|
|
## Identity and authorization
|
|
|
|
Authenticate on the server. Bind private reads and writes to the caller's allowed
|
|
resources and tenant. Prefer an ownership predicate in the data operation; a
|
|
separate read-check-write sequence can race. Verify cookie-authenticated mutations
|
|
have appropriate CSRF/origin protections and session expiry behavior.
|
|
|
|
## Payloads and credentials
|
|
|
|
Validate runtime shapes and bound request bytes, field lengths, array counts, and
|
|
expensive processing. Reject invalid credentials without silent truncation. Hash
|
|
passwords with the framework's supported algorithm and settings; bcrypt's 72-byte
|
|
input limitation is bytes, not characters. Use the selected algorithm's documented
|
|
limits and preserve long-password support when choosing the design.
|
|
|
|
## Uploads
|
|
|
|
Choose an explicit extension/content allowlist and byte cap per supported format.
|
|
Stop streaming at the cap. Inspect content with a suitable parser; signatures alone
|
|
cannot validate the whole file. Generate storage IDs; keep the storage root isolated
|
|
and non-executable, prevent traversal/symlink escapes, and bound archive expansion.
|
|
Serve active content in an appropriate isolated origin or as an attachment. Apply
|
|
malware scanning or re-encoding when the threat model warrants it.
|
|
|
|
## User-influenced outbound requests
|
|
|
|
Prefer service allowlists. Resolve all IPv4/IPv6 addresses and validate the actual
|
|
connection destination, including DNS changes. Disable redirects or repeat checks
|
|
for each hop. Bound time, bytes, and egress. Trusted internal service calls use their
|
|
own allowlist rather than a blanket private-network ban.
|
|
See [OWASP SSRF guidance](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html).
|
|
|
|
## Browser and abuse controls
|
|
|
|
Use CSP, framing rules, safe content types, CSRF protection, and rate limiting for
|
|
the relevant flow. Configure limits by actor, cost, and deployment topology. Apply
|
|
HSTS only to intended HTTPS domains; subdomains/preload require deliberate coverage.
|
|
Do not disable required browser capabilities through a blanket Permissions-Policy.
|
|
|
|
## Verification
|
|
|
|
Test relevant unauthorized and malformed cases. Audit dependencies when dependency
|
|
risk is part of the task; inspect the result before changing versions. Do not run
|
|
`npm audit fix` as an automatic audit step or change the user's stack by default.
|
|
Follow [shared verification](../../../protocols/workflow.md#verification).
|