48 lines
1.8 KiB
Markdown
48 lines
1.8 KiB
Markdown
|
# OWASP-aligned security checklist (agent reference)
|
||
|
|
|
||
|
|
Cite the **layer + item** in findings (e.g. "Layer 2 — IDOR"). Not a substitute for penetration testing.
|
||
|
|
|
||
|
|
## Layer 1 — Authentication
|
||
|
|
|
||
|
|
- [ ] All non-public API routes call a shared auth helper
|
||
|
|
- [ ] Login/register/forgot-password rate limited
|
||
|
|
- [ ] Session/JWT secret from environment; app fails start if missing
|
||
|
|
- [ ] No long-lived tokens in `localStorage` without documented threat model
|
||
|
|
- [ ] Password reset tokens single-use + short TTL
|
||
|
|
- [ ] No credentials in URLs or query strings
|
||
|
|
|
||
|
|
## Layer 2 — Authorization
|
||
|
|
|
||
|
|
- [ ] Resource IDs in path/body checked against session user/tenant
|
||
|
|
- [ ] List endpoints filter by ownership — no "return all rows"
|
||
|
|
- [ ] Admin operations behind explicit admin guard
|
||
|
|
- [ ] Role checks use server-side source of truth (DB), not client-only flags
|
||
|
|
- [ ] Bulk operations cannot target arbitrary user IDs
|
||
|
|
|
||
|
|
## Layer 3 — Input & injection
|
||
|
|
|
||
|
|
- [ ] All POST/PATCH/PUT bodies validated with schema
|
||
|
|
- [ ] Query params validated/coerced (Zod `z.coerce` or explicit parse)
|
||
|
|
- [ ] ORM/raw SQL uses parameters only
|
||
|
|
- [ ] No `dangerouslySetInnerHTML` without DOMPurify or equivalent
|
||
|
|
- [ ] File paths constructed server-side; no `../` from user input
|
||
|
|
- [ ] SSRF: server-side fetch URLs not user-controlled to internal IPs
|
||
|
|
|
||
|
|
## Layer 4 — Secrets & data
|
||
|
|
|
||
|
|
- [ ] No secrets in git history in this diff
|
||
|
|
- [ ] `NEXT_PUBLIC_` prefix only on truly public values
|
||
|
|
- [ ] PII minimized in logs and analytics events
|
||
|
|
- [ ] API responses omit internal IDs when unnecessary
|
||
|
|
|
||
|
|
## Layer 5 — Dependencies
|
||
|
|
|
||
|
|
- [ ] No new high/critical `npm audit` findings introduced
|
||
|
|
- [ ] Auth/crypto libs from reputable sources, pinned versions
|
||
|
|
|
||
|
|
## Layer 6 — Transport & config
|
||
|
|
|
||
|
|
- [ ] Auth cookies: Secure + HttpOnly
|
||
|
|
- [ ] CORS allowlist explicit for API routes
|
||
|
|
- [ ] Webhook endpoints verify signatures
|