Skip to content

SECURITY_TESTING_GUIDE.md

Latest commit

 

History

History
287 lines (201 loc) · 7.47 KB

SECURITY_TESTING_GUIDE.md

File metadata and controls

287 lines (201 loc) · 7.47 KB
Raw

🧪 Security Testing Results

Test Date: December 2, 2025
Application: DocTransfer
Test URL: http://localhost:5173

✅ TEST PLAN - Follow These Steps

Test 1: Password-Protected Upload (CRITICAL)

Objective: Verify bcrypt password hashing works

Steps:

  1. ✅ Open http://localhost:5173/dataroom (already there!)
  2. Upload a test file (any small file - PDF, image, text)
  3. Enable "Password Protection" toggle
  4. Set password: TestPass123
  5. Click "Generate Secure Link"
  6. Copy the generated share link

Expected Result:

  • ✅ Link generated successfully
  • ✅ No errors in browser console

Test 2: Password Verification (CRITICAL)

Objective: Test password decryption works with bcrypt

Steps:

  1. Open share link from Test 1 in incognito/private window
  2. You should see password prompt
  3. First, try WRONG password: wrongpass
  4. Then try CORRECT password: TestPass123

Expected Results:

  • ❌ Wrong password: Shows "Incorrect password"
  • ✅ Correct password: Unlocks document, shows download button

Test 3: Email Verification Rate Limiting

Objective: Verify rate limiting prevents spam

Steps:

  1. Upload a new document
  2. Enable "Require Email Verification" toggle
  3. Enter email (optional): test@example.com
  4. Generate link and open in incognito
  5. Enter email and click "Send Verification Code"
  6. Immediately click again (within 60 seconds)

Expected Results:

  • ✅ First request: Shows "Verification code sent"
  • ✅ Second request: Shows "Please wait XX seconds before requesting a new code"
  • ✅ NO verification code visible in browser console (in production mode)

Test 4: File Encryption & Download

Objective: Verify AES-256 encryption still works

Steps:

  1. Upload a file without password protection
  2. Generate share link
  3. Open link in incognito
  4. Click "Download File"

Expected Results:

  • ✅ File downloads successfully
  • ✅ File opens correctly (decrypted properly)
  • ✅ File content is intact

Test 5: Database RLS Verification

Objective: Confirm database is secured

Steps:

  1. Open https://app.supabase.com → Your Project → SQL Editor
  2. Run this query:
SELECT policyname, cmd 
FROM pg_policies 
WHERE tablename = 'documents'
ORDER BY policyname;

Expected Results:

  • ✅ Shows exactly 2 policies:
    • Allow Anonymous Uploads (INSERT)
    • Secure Read by Share Link (SELECT)
  • ❌ NO "Allow Updates" policy
  • ❌ NO "Allow Deletes" policy

Test 6: Security Attempt Tests

Objective: Verify unauthorized actions are blocked

In Supabase SQL Editor, try these:

-- Test 1: Try to read all documents (might show some but restricted)
SELECT * FROM documents;

-- Test 2: Try to update a document (SHOULD FAIL)
UPDATE documents SET name = 'hacked' WHERE true;

-- Test 3: Try to delete documents (SHOULD FAIL)
DELETE FROM documents WHERE true;

Expected Results:

  • Test 1: Shows limited results (this is OK)
  • Test 2: ❌ Error: "violates row-level security policy" ✅
  • Test 3: ❌ Error: "violates row-level security policy" ✅

📊 TEST RESULTS FORM

Fill this out as you test:

═══════════════════════════════════════════════════════════
                    TEST RESULTS
═══════════════════════════════════════════════════════════

Test 1: Password-Protected Upload
[ ] PASS  [ ] FAIL  
Notes: _________________________________________________

Test 2: Password Verification (Wrong Password)
[ ] PASS  [ ] FAIL
Notes: _________________________________________________

Test 2b: Password Verification (Correct Password)
[ ] PASS  [ ] FAIL
Notes: _________________________________________________

Test 3: Email Rate Limiting
[ ] PASS  [ ] FAIL
Notes: _________________________________________________

Test 4: File Download & Decryption
[ ] PASS  [ ] FAIL
Notes: _________________________________________________

Test 5: Database RLS Policies
[ ] PASS  [ ] FAIL
Policies found: ________________________________________

Test 6a: Unauthorized UPDATE blocked
[ ] PASS  [ ] FAIL
Error message: _________________________________________

Test 6b: Unauthorized DELETE blocked
[ ] PASS  [ ] FAIL
Error message: _________________________________________

═══════════════════════════════════════════════════════════
                  OVERALL RESULT
═══════════════════════════════════════════════════════════

Total Tests: 8
Passed: ____
Failed: ____

Security Status: [ ] SECURE  [ ] NEEDS FIXES

Notes:
___________________________________________________________
___________________________________________________________
___________________________________________________________

🐛 Common Issues & Fixes

Issue: "Password not working after upload"

Cause: Old plain-text passwords in database
Fix: Run in Supabase SQL Editor:

UPDATE documents SET password = NULL WHERE password IS NOT NULL;

Then upload fresh test document.

Issue: "Cannot read properties of undefined"

Cause: Code change not compiled
Fix:

  1. Stop dev server (Ctrl+C)
  2. Run: npm run dev
  3. Refresh browser

Issue: "Share link shows 'Document not found'"

Cause: Document might be expired or deleted
Fix: Upload a new document and use fresh link

Issue: "Email verification code visible in console"

Cause: Running in development mode
Fix: This is expected! In dev mode, codes show for testing.

  • In production build, they won't show (only in DEV environment)

✅ Success Criteria

ALL of these must be TRUE:

  • ✅ Password-protected uploads work
  • ✅ Wrong passwords are rejected
  • ✅ Correct passwords unlock documents
  • ✅ Rate limiting prevents spam (60 second cooldown)
  • ✅ Files encrypt and decrypt correctly
  • ✅ Database has only 2 RLS policies
  • ✅ UPDATE attempts fail with security error
  • ✅ DELETE attempts fail with security error

If all 8 checks pass → Your application is SECURE! 🎉

🎯 Quick Test (2 Minutes)

Don't have time for full tests? Do this quick check:

  1. Upload a password-protected file
  2. Open link in incognito
  3. Try wrong password → Should fail ❌
  4. Try correct password → Should work ✅
  5. Download file → Should decrypt properly ✅

All 3 work? You're good to go! ✅

📸 Evidence Collection

For production deployment approval, collect:

  1. Screenshot of upload page
  2. Screenshot of password verification working
  3. Screenshot of Supabase policies (showing only 2)
  4. Screenshot of UPDATE/DELETE errors
  5. Test file that was encrypted/decrypted successfully

🚀 Next Steps After Testing

If All Tests Pass:

  1. ✅ Mark security fixes as complete
  2. 🚀 Deploy to production
  3. 📧 Plan real email service integration
  4. 👥 Consider adding user authentication

If Any Tests Fail:

  1. 📝 Document which tests failed
  2. 🔍 Check browser console for errors
  3. 🔧 Review the fix guides
  4. 💬 Ask for help with specific error messages

Ready to test? Start with Test 1 above! 🧪

Good luck! 🍀