commited

[deeptesh-rout]

Which issue does this PR close?

• Closes #

---

Rationale for this change

• Enhance backend security by improving authentication, input validation, rate limiting, and HTTP headers.
• Fix potential issues with JWT authentication, including expired tokens and missing users.
• Make API more resilient to common attacks like XSS, CSRF, and brute-force login attempts.
• Improve developer experience with reusable validation logic and structured error messages.

---

What changes are included in this PR?

• Authentication Middleware:

  • Handles expired and invalid JWTs.
  • Fetches user from DB and attaches full user object.
  • Added optional authorizeRoles middleware for role-based access control.

• Security Enhancements:

  • Added helmet for advanced HTTP headers.
  • Extended input sanitization to req.body, req.query, and req.params.
  • Improved XSS protection using the xss library.
  • Configured HSTS only in production.

• Rate Limiting:

  • Separate limits for authentication routes and general API routes.
  • Provides descriptive messages when limits are exceeded.

• Validation Middleware:

  • Centralized handleValidationErrors for structured error responses.
  • Reusable validators for names, passwords, emails, and order fields.
  • Optional chaining for nested fields to prevent crashes.

---

Are these changes tested?

• ✅ Unit tests cover authentication and validation middleware.

• ✅ Manual testing with Postman for:

  • User registration/login
  • Order placement and updates
  • Newsletter subscription
    *SOME UI changes; backend updates.

---

Are there any user-facing changes?

• Users will see more descriptive error messages:

  • Expired or invalid JWTs.
  • Validation errors on registration, login, or order submission.
  • Rate limit exceeded messages.

• No changes to frontend or UI.

---

Screenshots (if applicable)

• N/A – backend-only improvements.

[github-actions]

Thanks for creating a PR for your Issue! ☺️

We'll review it as soon as possible.
In the meantime, please double-check the file changes and ensure that all commits are accurate.

If there are any unresolved review comments, feel free to resolve them. 🙌🏼

[Skrishna0703]

share the issue number