Skip to content

SECURITY_NOTES.md

Latest commit

 

History

History
240 lines (185 loc) · 6.02 KB

SECURITY_NOTES.md

File metadata and controls

240 lines (185 loc) · 6.02 KB
Raw

🔐 Security Hardening - Noted Application

Critical Changes Made

1. ✅ Secrets Management

Before ❌

DB_PASSWORD=yourpassword
JWT_SECRET=your-super-secret-jwt-key-here
VITE_FIREBASE_API_KEY=AIzaSyDGd0lcf3Hx6I05-PGXbW9Dxf7_EvEjqa4

After ✅

DB_PASSWORD=change_me_strong_password  # Must be changed
JWT_SECRET=change_me_generate_strong_random_key  # Must be changed
# Credentials in .env.example only, never in git

2. ✅ Removed Token Logging

Before ❌

console.log("🔑 Token length:", token?.length || 0);
console.log(`❌ [${status}] ${url}`, error.response?.data);

After ✅

// No token content logged - security logs only
if (token) {
  config.headers.Authorization = `Bearer ${token}`;
}

3. ✅ Fixed CORS Configuration

Before ❌

proxy_set_header Access-Control-Allow-Origin *;  // Allows ANY origin

After ✅

allowed := false
for _, allowedOrigin := range origins {
  if strings.TrimSpace(allowedOrigin) == origin {
    allowed = true
    break
  }
}
if allowed {
  c.Header("Access-Control-Allow-Origin", origin)
}

4. ✅ Updated .gitignore

Added:

  • .env - never commit environment variables
  • .env.local - local overrides
  • firebase-credentials.json - service account keys
  • *.json - credential files

5. ✅ Enhanced Nginx Security

Added Headers:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self' https:; ...";

Removed:

  • Basic auth (ineffective against determined attackers)
  • Wildcard CORS headers

6. ✅ Docker Compose Security

Fixed:

  • Backend context path: ./notedSpring → ./backend
  • Environment variables via .env file instead of hardcoded
  • MySQL version pinned: mysql:latest → mysql:8.0
  • Health checks added for proper service startup

🔑 Secrets You Must Generate

Database Password

openssl rand -hex 16
# Example: a7c3e9f2b1d4c6a8e5f2b9c1d8a7e3f4

JWT Secret

openssl rand -hex 32
# Example: 3f8a2b1c9d7e4a6f5c8b2d1a9e3f7c4b6a8d5f2e1c9b7a4d3e6f8a1b2c9d

Database Root Password

  • Minimum 16 characters
  • Mix uppercase, lowercase, numbers, special chars
  • Example: P@ssw0rd!Secure#Key2024

🚨 Security Vulnerabilities FIXED

Issue Severity Status Fix
Firebase API key in .env CRITICAL ✅ FIXED Moved to .env.example
Google OAuth client secret exposed CRITICAL ✅ FIXED Removed from frontend
DB password in compose file CRITICAL ✅ FIXED Environment variables
JWT secret weak/exposed CRITICAL ✅ FIXED Strong random generation
.env files in git CRITICAL ✅ FIXED Added to .gitignore
Token logged in console HIGH ✅ FIXED Removed debug logs
CORS wildcard * HIGH ✅ FIXED Whitelist approach
SSL cert in repo HIGH ✅ FIXED Move to deployment
Database errors exposed MEDIUM ✅ FIXED Generic error messages
No HTTPS headers MEDIUM ✅ FIXED Added Nginx security headers

📋 Before Deploying to Production

1. Clean Git History (if needed)

If .env files with secrets were ever committed:

# Install git-filter-repo
pip install git-filter-repo

# Remove from history
git-filter-repo --invert-paths --path backend/.env --path NoteFront/.env

# Force push (affects all users)
git push --force-all

2. Rotate Firebase Credentials

# Delete exposed API key in Firebase Console
# Create new OAuth 2.0 Client ID
# Update .env with new credentials

3. Change Database Passwords

# Generate new password
openssl rand -hex 16

# Update all .env files
# Stop and restart docker-compose
docker-compose down
docker-compose up -d

4. Generate New JWT Secret

openssl rand -hex 32
# Update backend/.env with new value
docker-compose restart backend

5. Verify No Secrets in Current .env

# This file should NOT be in git
git ls-files | grep "\.env$"

# Should return NOTHING. If it does:
git rm --cached backend/.env NoteFront/.env
git commit -m "Remove .env files from tracking"

6. Enable HTTPS

  • Obtain SSL certificate (Let's Encrypt recommended)
  • Place in Nginx/https/certificate.crt and Nginx/https/private.key
  • Update domain in Nginx/default.conf
  • Ensure HSTS header enabled

🔒 Production Security Checklist

  • All .env files NOT in git (git status shows nothing)
  • Firebase credentials rotated and .env.example cleaned
  • Database password: 20+ chars, randomly generated
  • JWT secret: 32 bytes, randomly generated (openssl rand -hex 32)
  • CORS origins: specific domains, NO wildcards
  • SSL/TLS: valid certificate, HTTPS enforced
  • Nginx headers: all security headers present
  • Backend logs: no token/secret exposure
  • Docker compose: uses .env file, not hardcoded values
  • API errors: generic messages, no schema exposure
  • Rate limiting: implemented on auth endpoints
  • Firewall: restrict access to non-standard ports

🛡️ Ongoing Security

Regular Updates

docker-compose pull  # Get latest base images
docker-compose build --no-cache
docker-compose up -d

Monitor Logs

docker-compose logs --tail=100 | grep -i error
docker-compose logs --tail=100 | grep -i auth

Backup Credentials

# Safe backup of firebase-credentials.json
cp backend/firebase-credentials.json backup/firebase-credentials.json.bak
chmod 600 backup/firebase-credentials.json.bak

References