Security Best Practices

AI-generated code often:
├── Prioritizes functionality over security
├── Uses outdated security patterns
├── Misses edge cases in validation
├── Hardcodes sensitive values
├── Trusts user input implicitly
└── Lacks proper error handling

Common AI-introduced vulnerabilities:
- SQL Injection (unsanitized queries)
- XSS (unescaped user content)
- Authentication bypass (missing checks)
- Information disclosure (verbose errors)
- CSRF (missing tokens)

// ❌ AI often generates client-side only validation
function CreateUser({ onSubmit }) {
  const [email, setEmail] = useState('')

  const handleSubmit = () => {
    if (email.includes('@')) {  // Client-side only!
      onSubmit(email)
    }
  }
}

// ✓ Always validate on server
import { z } from 'zod'

const userSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
  age: z.number().int().min(0).max(150),
})

export async function POST(request: Request) {
  const body = await request.json()

  const result = userSchema.safeParse(body)
  if (!result.success) {
    return Response.json(
      { error: 'Invalid input', details: result.error.issues },
      { status: 400 }
    )
  }

  // result.data is now typed and validated
  const { email, name, age } = result.data
  // ...
}

// ❌ Directly rendering user content
function Comment({ comment }) {
  return <div dangerouslySetInnerHTML={{ __html: comment.body }} />
}

// ✓ Sanitize HTML or use text content
import DOMPurify from 'dompurify'

function Comment({ comment }) {
  // Option 1: Sanitize if HTML is needed
  const sanitized = DOMPurify.sanitize(comment.body)
  return <div dangerouslySetInnerHTML={{ __html: sanitized }} />

  // Option 2: Plain text (preferred)
  return <div>{comment.body}</div>
}

// ❌ String interpolation (SQL Injection vulnerable)
const query = `SELECT * FROM users WHERE id = '${userId}'`

// ✓ Parameterized query (Supabase)
const { data } = await supabase
  .from('users')
  .select('*')
  .eq('id', userId)

// ✓ Parameterized query (Prisma)
const user = await prisma.user.findUnique({
  where: { id: userId }
})

// ✓ Parameterized query (raw SQL)
const users = await prisma.$queryRaw`
  SELECT * FROM users WHERE id = ${userId}
`

// ✓ Validate UUID format before using
import { z } from 'zod'

const uuidSchema = z.string().uuid()

export async function GET(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const result = uuidSchema.safeParse(id)
  if (!result.success) {
    return Response.json({ error: 'Invalid ID' }, { status: 400 })
  }

  const user = await getUser(result.data)
  // ...
}

// ❌ Missing auth check
export async function GET(request: Request) {
  const orders = await db.orders.findMany()
  return Response.json(orders)
}

// ✓ Always verify auth
import { createClient } from '@/lib/supabase/server'

export async function GET(request: Request) {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()

  if (!user) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const orders = await db.orders.findMany({
    where: { userId: user.id }  // Also filter by user!
  })
  return Response.json(orders)
}

// ❌ Only checking if logged in
export async function DELETE(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const user = await getUser()
  if (!user) return unauthorized()

  await db.posts.delete({ where: { id } })  // Anyone can delete!
}

// ✓ Verify ownership or role
export async function DELETE(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const user = await getUser()
  if (!user) return unauthorized()

  const post = await db.posts.findUnique({ where: { id } })

  // Check ownership
  if (post.authorId !== user.id) {
    // Or check admin role
    if (user.role !== 'admin') {
      return Response.json({ error: 'Forbidden' }, { status: 403 })
    }
  }

  await db.posts.delete({ where: { id } })
}

// ❌ Hardcoded secrets
const STRIPE_KEY = 'sk_live_abc123...'
const DATABASE_URL = 'postgresql://user:password@host/db'

// ✓ Environment variables
const STRIPE_KEY = process.env.STRIPE_SECRET_KEY!
const DATABASE_URL = process.env.DATABASE_URL!

# .env.local

# Server-only (never exposed to browser)
STRIPE_SECRET_KEY=sk_live_...
DATABASE_URL=postgresql://...
JWT_SECRET=...

# Public (exposed to browser)
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_...
NEXT_PUBLIC_API_URL=https://api.example.com

// ❌ Using server secret on client
'use client'
const key = process.env.STRIPE_SECRET_KEY  // Will be undefined!

// ✓ Use NEXT_PUBLIC_ prefix for client
'use client'
const key = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY

// ❌ Verbose errors expose internals
catch (error) {
  return Response.json({
    error: error.message,  // "relation 'users' does not exist"
    stack: error.stack     // Full stack trace!
  })
}

// ✓ Generic errors for clients, detailed logs server-side
catch (error) {
  console.error('Database error:', error)  // Log full error server-side

  return Response.json({
    error: 'Something went wrong'  // Generic message to client
  }, { status: 500 })
}

// Next.js Server Actions have built-in CSRF protection
// For custom API routes, verify origin:

export async function POST(request: Request) {
  const origin = request.headers.get('origin')
  const host = request.headers.get('host')

  // Verify request origin matches host
  if (origin && !origin.includes(host!)) {
    return Response.json({ error: 'Forbidden' }, { status: 403 })
  }

  // Process request...
}

// Simple in-memory rate limiting (use Redis for production)
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, '10 s'),  // 10 requests per 10 seconds
})

export async function POST(request: Request) {
  const ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1'

  const { success, limit, reset, remaining } = await ratelimit.limit(ip)

  if (!success) {
    return Response.json(
      { error: 'Too many requests' },
      {
        status: 429,
        headers: {
          'X-RateLimit-Limit': limit.toString(),
          'X-RateLimit-Remaining': remaining.toString(),
          'X-RateLimit-Reset': reset.toString(),
        }
      }
    )
  }

  // Process request...
}

// next.config.ts
const securityHeaders = [
  {
    key: 'X-DNS-Prefetch-Control',
    value: 'on'
  },
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload'
  },
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN'
  },
  {
    key: 'X-Content-Type-Options',
    value: 'nosniff'
  },
  {
    key: 'Referrer-Policy',
    value: 'origin-when-cross-origin'
  },
  {
    key: 'Content-Security-Policy',
    value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';"
  }
]

export default {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: securityHeaders,
      },
    ]
  },
}

"Review this code for security vulnerabilities:
[paste code]

Check for:
- SQL injection
- XSS vulnerabilities
- Missing authentication
- Missing authorization
- Hardcoded secrets
- Information disclosure
- Input validation issues
- CSRF vulnerabilities

Provide specific fixes for each issue found."

"Generate a secure user registration API endpoint with:
- Input validation using Zod
- Password hashing with bcrypt
- Rate limiting
- Sanitized error messages
- Proper TypeScript types

Follow OWASP best practices."

## Pre-Deployment Security Checklist

### Authentication & Authorization
- [ ] All protected routes verify authentication
- [ ] Authorization checks verify ownership/role
- [ ] Sessions expire appropriately
- [ ] Password requirements enforced

### Input Handling
- [ ] All user input validated server-side
- [ ] SQL queries use parameterization
- [ ] User content sanitized before rendering
- [ ] File uploads validated (type, size)

### Sensitive Data
- [ ] No hardcoded secrets in code
- [ ] Server secrets not exposed to client
- [ ] Errors don't leak internal details
- [ ] PII encrypted at rest

### Headers & Transport
- [ ] HTTPS enforced
- [ ] Security headers configured
- [ ] CORS configured correctly
- [ ] Rate limiting in place

### Monitoring
- [ ] Security events logged
- [ ] Failed login attempts tracked
- [ ] Error monitoring configured