A full-stack security review

Why a review, not one fix

Attackers do not need ten holes. They need one. A security review means you walk through every part of the app, frontend, backend, database and hosting, with a checklist, and fix what is missing. Do it before launch and after every big feature.

Authorization on every endpoint (no IDOR)

IDOR means Insecure Direct Object Reference. It happens when a user changes /api/notes/41 to /api/notes/42 in the URL and sees someone else's note. Being logged in is not enough: the server must check that this note belongs to this user, on every route.

// GET /api/notes/:id
app.get('/api/notes/:id', requireLogin, (req, res) => {
  const note = db
    .prepare('SELECT id, title, body, pinned FROM notes WHERE id = ? AND user_id = ?')
    .get(Number(req.params.id), req.user.id);
  // 404 (not 403) so we do not even reveal that note 42 exists
  if (!note) return res.status(404).json({ error: 'Note not found' });
  res.json(note);
});

XSS: escape everything you show

// DANGEROUS: a note titled <img src=x onerror="stealCookies()"> would run code
card.innerHTML = '<h2>' + note.title + '</h2>';

// SAFE: the browser shows the text as text
const h2 = document.createElement('h2');
h2.textContent = note.title;
card.appendChild(h2);

// In React, {note.title} is escaped for you. Avoid dangerouslySetInnerHTML.

Cookies and security headers

Set-Cookie: sid=8f2c...; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=604800

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

Secrets, updates, limits, logs and backups

• Secrets out of git: if a key was ever committed, deleting the file is not enough. Rotate (replace) the key, because the old one stays in git history.
• Dependency updates: run npm audit, turn on Dependabot alerts in GitHub, and update packages in small, regular steps.
• Rate limiting: for example, 5 login tries per minute per IP and per email. OTP routes need limits too, or someone can guess a 6-digit OTP or run up your SMS bill.
• Logging: log what happened (user id 17 failed login, request id abc), not secrets or personal data. Mask phone numbers and emails if you must log them.
• Backups: a backup you never restored is a hope, not a backup. Try a restore into a test database once a month.