Security Hardening

# TaskFlow Phase 29 Security Hardening Snapshot

Reference artifacts for the production hardening pass. Keep these controls aligned with the real deployment topology and verify them with tests.

# TaskFlow security hardening checklist

## HTTP / browser
- HTTPS only in production
- security headers verified
- CORS exact origins, methods and headers
- CSP designed/tested for deployed Next.js app
- no state-changing GET endpoints

## Identity / authorization
- JWT signature + issuer/audience/expiry verified
- authSubject mapping unique
- resource queries tenant-scoped
- 401/403/404 behavior tested
- role escalation denied

## Input / output
- server Zod validation on every untrusted body/query/path
- lengths/ranges/enums bounded
- React text rendering by default

- OWASP ASVS 5.0.0: https://owasp.org/projects/asvs
- OWASP Input Validation: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
- OWASP XSS Prevention: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- OWASP CSRF Prevention: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
- OWASP HTTP Headers: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
- OWASP REST Security: https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html
- OWASP File Upload: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
- OWASP Logging: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
- OWASP Secrets Management: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
- NestJS Rate Limiting: https://docs.nestjs.com/security/rate-limiting
- @fastify/helmet: https://www.npmjs.com/package/@fastify/helmet
- @nestjs/throttler: https://www.npmjs.com/package/@nestjs/throttler
- Next.js Support Policy: https://nextjs.org/support-policy

# TaskFlow threat model

Assets: authentication sessions, tenant business data, attachments, secrets, authorization decisions, audit/log evidence, service availability.

Entry points: Next.js pages/actions, NestJS HTTP API, Supabase Auth, Realtime, Storage signed uploads/downloads, PostgreSQL, deployment configuration.

Representative abuse cases:
- stolen/replayed access token
- cross-workspace object ID tampering
- brute-force / request flooding
- XSS through user content
- CSRF against cookie-authenticated flows
- malicious/oversized upload
- service-role key leaked to browser/logs
- dependency vulnerability left unpatched

- @fastify/helmet: 13.1.1
- @nestjs/throttler: 6.5.0
- OWASP ASVS: 5.0.0
- Next.js: 16.x Active LTS
- NestJS: 12.x
- Fastify: 5.x

WEB_ORIGIN=http://localhost:3000
DATABASE_URL=
SUPABASE_URL=
SUPABASE_SERVICE_ROLE_KEY=

# Never prefix server secrets with NEXT_PUBLIC_.

pnpm --filter api add @fastify/helmet@13.1.1 @nestjs/throttler@6.5.0

import helmet from "@fastify/helmet";

// After NestFactory.create<NestFastifyApplication>(...)
const fastify = app.getHttpAdapter().getInstance();
await fastify.register(helmet, {
  global: true,
  // The API returns JSON. Define the web-page CSP at the Next.js layer.
  contentSecurityPolicy: false,
});

app.enableCors({
  origin: [process.env.WEB_ORIGIN!],
  methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
  allowedHeaders: ["Content-Type", "Authorization"],
});

import { Module } from "@nestjs/common";
import { APP_GUARD } from "@nestjs/core";
import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";

@Module({
  imports: [
    ThrottlerModule.forRoot([
      { name: "short", ttl: 1_000, limit: 10 },
      { name: "minute", ttl: 60_000, limit: 120 },
    ]),
  ],
  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
  exports: [ThrottlerModule],
})
export class SecurityModule {}

import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  async headers() {
    return [{
      source: "/(.*)",
      headers: [
        { key: "X-Content-Type-Options", value: "nosniff" },
        { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
        { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
        { key: "X-Frame-Options", value: "DENY" },
      ],
    }];
  },
};

export default nextConfig;

// CSP intentionally omitted from this generic snapshot.
// Build/test a deployment-specific nonce/hash policy instead of shipping

# Phase 29 security test matrix

## Headers
- API emits expected security headers
- Next.js emits nosniff/referrer/frame policy

## Rate limiting
- burst beyond route policy -> 429
- trusted proxy configuration preserves intended client tracker

## Input / errors
- oversized title/search/body rejected
- unknown fields rejected
- public 500 contains no stack/SQL/secret

## Authentication / authorization
- missing/expired/wrong-project token -> 401
- cross-workspace ID -> scoped 404/deny
- MEMBER role escalation -> forbidden