Skip to content

Commit 6cf05a5

Browse files
tanzilahmed0tanzilahmed0
authored
Merge pull request #36 from tanzilahmed0/task-b28
Task B28: Security and Error Handling
2 parents 92a8a9f + c7b5909 commit 6cf05a5

8 files changed

Lines changed: 1840 additions & 43 deletions

File tree

‎backend/api/middleware/cors.py‎

Lines changed: 109 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,126 @@
1+
import logging
12
import os
23

34
from fastapi import FastAPI
45
from fastapi.middleware.cors import CORSMiddleware
56

7+
logger = logging.getLogger(__name__)
8+
69

710
def setup_cors(app: FastAPI) -> None:
8-
"""Configure CORS middleware for the FastAPI application"""
11+
"""Configure secure CORS middleware for the FastAPI application"""
912

10-
# Get allowed origins from environment
11-
allowed_origins = [
12-
"http://localhost:3000", # Next.js development server
13-
"https://localhost:3000", # HTTPS development
14-
os.getenv("FRONTEND_URL", "http://localhost:3000"), # Production frontend URL
15-
]
13+
environment = os.getenv("ENVIRONMENT", "development")
14+
is_production = environment == "production"
15+
16+
# Get allowed origins from environment with security considerations
17+
allowed_origins = []
18+
19+
if not is_production:
20+
# Development origins
21+
allowed_origins.extend(
22+
[
23+
"http://localhost:3000", # Next.js development server
24+
"http://127.0.0.1:3000", # Alternative localhost
25+
"https://localhost:3000", # HTTPS development
26+
"https://127.0.0.1:3000", # HTTPS alternative localhost
27+
]
28+
)
29+
30+
# Add production frontend URL
31+
frontend_url = os.getenv("FRONTEND_URL")
32+
if frontend_url:
33+
allowed_origins.append(frontend_url)
34+
# Also add HTTPS version if HTTP is provided
35+
if frontend_url.startswith("http://"):
36+
allowed_origins.append(frontend_url.replace("http://", "https://"))
1637

1738
# Add additional origins from environment variable if specified
1839
additional_origins = os.getenv("ADDITIONAL_CORS_ORIGINS", "")
1940
if additional_origins:
20-
allowed_origins.extend(additional_origins.split(","))
41+
# Validate and sanitize additional origins
42+
origins = [
43+
origin.strip() for origin in additional_origins.split(",") if origin.strip()
44+
]
45+
for origin in origins:
46+
if _is_valid_origin(origin):
47+
allowed_origins.append(origin)
48+
else:
49+
logger.warning(f"Invalid CORS origin ignored: {origin}")
50+
51+
# Remove duplicates while preserving order
52+
allowed_origins = list(dict.fromkeys(allowed_origins))
53+
54+
# Secure methods - restrict to only what we need
55+
allowed_methods = [
56+
"GET",
57+
"POST",
58+
"PUT",
59+
"DELETE",
60+
"OPTIONS", # Required for CORS preflight
61+
]
62+
63+
# Secure headers - be specific about what we allow
64+
allowed_headers = [
65+
"Accept",
66+
"Accept-Language",
67+
"Content-Type",
68+
"Authorization",
69+
"X-Requested-With",
70+
"Cache-Control",
71+
]
72+
73+
# Expose only necessary headers
74+
expose_headers = [
75+
"X-Total-Count",
76+
"X-RateLimit-Limit",
77+
"X-RateLimit-Remaining",
78+
"X-Process-Time",
79+
]
80+
81+
logger.info(f"CORS configured for environment: {environment}")
82+
logger.info(f"Allowed origins: {allowed_origins}")
2183

2284
app.add_middleware(
2385
CORSMiddleware,
2486
allow_origins=allowed_origins,
25-
allow_credentials=True,
26-
allow_methods=["*"],
27-
allow_headers=["*"],
87+
allow_credentials=True, # Required for auth cookies/headers
88+
allow_methods=allowed_methods,
89+
allow_headers=allowed_headers,
90+
expose_headers=expose_headers,
91+
max_age=600, # Cache preflight responses for 10 minutes
92+
)
93+
94+
95+
def _is_valid_origin(origin: str) -> bool:
96+
"""Validate that an origin is properly formatted and secure"""
97+
import re
98+
99+
# Basic URL pattern validation
100+
url_pattern = re.compile(
101+
r"^https?://" # http:// or https://
102+
r"(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+[A-Z]{2,6}\.?|" # domain
103+
r"localhost|" # localhost
104+
r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" # IP
105+
r"(?::\d+)?" # optional port
106+
r"(?:/?|[/?]\S+)$",
107+
re.IGNORECASE,
28108
)
109+
110+
if not url_pattern.match(origin):
111+
return False
112+
113+
# Prevent potentially dangerous origins
114+
dangerous_patterns = [
115+
r"javascript:",
116+
r"data:",
117+
r"file:",
118+
r"ftp:",
119+
r"about:",
120+
]
121+
122+
for pattern in dangerous_patterns:
123+
if re.search(pattern, origin, re.IGNORECASE):
124+
return False
125+
126+
return True

‎backend/docs/security_implementation.md‎

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
# SmartQuery Security Implementation - Task B28
2+
3+
This document outlines the comprehensive security measures implemented in SmartQuery API as part of Task B28: Security and Error Handling.
4+
5+
## Security Overview
6+
7+
SmartQuery implements a multi-layered security approach covering:
8+
- Authentication and authorization
9+
- Input validation and sanitization
10+
- Rate limiting and request throttling
11+
- Comprehensive error handling
12+
- Security headers and CORS configuration
13+
- Data protection and secure storage
14+
15+
## Authentication & Authorization
16+
17+
### JWT Token Security
18+
- **Strong Secret Keys**: Production requires minimum 32-character JWT secrets
19+
- **Token Expiration**: Access tokens expire in 60 minutes, refresh tokens in 30 days
20+
- **Token Blacklisting**: Implements token revocation and blacklisting system
21+
- **Unique Token IDs**: Each token has a unique JWT ID (jti) for tracking
22+
23+
### Google OAuth Integration
24+
- **Token Verification**: Validates Google OAuth tokens against Google's servers
25+
- **Email Verification**: Requires verified email addresses from Google
26+
- **Mock Mode**: Secure development mode with mock tokens
27+
- **Error Handling**: Comprehensive OAuth error handling
28+
29+
### Authentication Middleware
30+
- **Bearer Token Validation**: Proper HTTP Bearer token handling
31+
- **User Context Injection**: Secure user context for protected routes
32+
- **Role-Based Access**: Support for user roles and permissions
33+
- **Session Management**: Secure session handling and cleanup
34+
35+
## Input Validation & Sanitization
36+
37+
### Comprehensive Input Validation
38+
- **String Length Limits**: Enforced limits on all text inputs
39+
- Project names: 100 characters
40+
- Descriptions: 500 characters
41+
- Queries: 2000 characters
42+
- Email: 254 characters
43+
- **File Upload Validation**: Restricts file types to CSV only, max 100MB
44+
- **UUID Validation**: Strict UUID format validation
45+
- **Email Validation**: RFC-compliant email validation
46+
47+
### Malicious Content Detection
48+
- **SQL Injection Prevention**: Filters dangerous SQL keywords and patterns
49+
- **XSS Prevention**: HTML entity encoding for all user inputs
50+
- **Script Injection Detection**: Blocks JavaScript and VBScript injection attempts
51+
- **Path Traversal Prevention**: Blocks directory traversal attempts
52+
- **Command Injection Prevention**: Filters command injection patterns
53+
54+
### Sanitization Process
55+
- **HTML Encoding**: All user inputs are HTML-encoded
56+
- **Control Character Removal**: Strips null bytes and control characters
57+
- **Pattern Matching**: Uses regex patterns to detect malicious content
58+
- **Recursive Sanitization**: Sanitizes nested data structures
59+
60+
## Rate Limiting & Throttling
61+
62+
### Multi-Tier Rate Limiting
63+
- **Endpoint-Specific Limits**:
64+
- Authentication: 20 requests/minute
65+
- Projects: 50 requests/minute
66+
- Chat/AI: 30 requests/minute
67+
- Default: 100 requests/minute
68+
69+
### Advanced Rate Limiting Features
70+
- **User-Based Tracking**: Tracks requests per authenticated user
71+
- **IP-Based Fallback**: Rate limits for anonymous users
72+
- **Temporary Blocking**: Blocks users exceeding 3x the limit
73+
- **Sliding Windows**: Uses time-window based counting
74+
- **Graceful Headers**: Returns rate limit headers to clients
75+
76+
### Protection Against Abuse
77+
- **Burst Protection**: Prevents rapid-fire requests
78+
- **Distributed Denial of Service (DDoS) Mitigation**: Basic protection
79+
- **Request Pattern Analysis**: Monitors for suspicious patterns
80+
81+
## Error Handling & Security
82+
83+
### Secure Error Messages
84+
- **Information Leakage Prevention**: Sanitizes error messages in production
85+
- **Generic Production Errors**: Returns generic messages to prevent reconnaissance
86+
- **Detailed Development Errors**: Full error details in development mode
87+
- **Error ID Tracking**: Unique error IDs for support and debugging
88+
89+
### Comprehensive Error Logging
90+
- **Security Event Logging**: Dedicated security event logger
91+
- **Attack Detection**: Logs potential attack patterns
92+
- **Authentication Failures**: Tracks failed login attempts
93+
- **Input Validation Failures**: Logs validation errors for analysis
94+
95+
### Error Response Standardization
96+
- **Consistent Format**: All errors use standardized ApiResponse format
97+
- **Security Headers**: Security headers added to all error responses
98+
- **Status Code Mapping**: Proper HTTP status codes for different error types
99+
- **Sanitized Stack Traces**: Stack traces hidden in production
100+
101+
## Security Headers & CORS
102+
103+
### Comprehensive Security Headers
104+
- **Content Security Policy (CSP)**: Prevents XSS attacks
105+
- **X-Frame-Options**: Prevents clickjacking (set to DENY)
106+
- **X-Content-Type-Options**: Prevents MIME sniffing (set to nosniff)
107+
- **X-XSS-Protection**: Browser XSS protection enabled
108+
- **Strict-Transport-Security**: Forces HTTPS in production
109+
- **Referrer-Policy**: Controls referrer information leakage
110+
- **Permissions-Policy**: Restricts browser features
111+
112+
### Secure CORS Configuration
113+
- **Environment-Specific Origins**: Different origins for development/production
114+
- **Origin Validation**: Validates and sanitizes CORS origins
115+
- **Restricted Methods**: Only allows necessary HTTP methods
116+
- **Specific Headers**: Restricts allowed request headers
117+
- **Credential Support**: Secure credential handling for authenticated requests
118+
119+
## Data Protection
120+
121+
### Sensitive Data Handling
122+
- **Environment Variables**: All secrets stored in environment variables
123+
- **API Key Security**: OpenAI and other API keys properly secured
124+
- **Database Credentials**: Secure database connection handling
125+
- **Password Policies**: No plain text password storage
126+
- **Data Encryption**: Sensitive data encrypted at rest and in transit
127+
128+
### Secure Configuration
129+
- **Production Secrets**: Strong, unique secrets in production
130+
- **Development Defaults**: Secure defaults for development environment
131+
- **Configuration Validation**: Validates security configuration on startup
132+
- **Environment Separation**: Clear separation between development and production
133+
134+
## Security Middleware Architecture
135+
136+
### SecurityMiddleware
137+
- **Request Size Validation**: Prevents oversized requests
138+
- **Content Validation**: Validates request content types and structures
139+
- **Pattern Detection**: Real-time malicious pattern detection
140+
- **Response Headers**: Adds security headers to all responses
141+
142+
### Rate Limiting Integration
143+
- **Middleware Integration**: Seamlessly integrated with FastAPI
144+
- **Memory Efficient**: Efficient in-memory tracking with cleanup
145+
- **Redis Ready**: Prepared for Redis integration in production
146+
- **Configurable Limits**: Environment-based configuration
147+
148+
### Error Handler Integration
149+
- **Exception Tracking**: Comprehensive exception handling
150+
- **Security Event Generation**: Automatic security event logging
151+
- **Response Sanitization**: Sanitizes all error responses
152+
- **Attack Detection**: Detects and logs potential attacks
153+
154+
## Security Testing & Validation
155+
156+
### Input Validation Testing
157+
- **Boundary Testing**: Tests input length limits
158+
- **Injection Testing**: Tests for SQL injection, XSS, and other attacks
159+
- **Format Validation**: Tests UUID, email, and other format validators
160+
- **Malicious Pattern Testing**: Tests detection of malicious patterns
161+
162+
### Authentication Testing
163+
- **Token Validation**: Tests JWT token validation and expiration
164+
- **OAuth Integration**: Tests Google OAuth token verification
165+
- **Authorization Testing**: Tests protected endpoint access
166+
- **Session Management**: Tests session handling and cleanup
167+
168+
### Rate Limiting Testing
169+
- **Limit Enforcement**: Tests rate limit enforcement
170+
- **Burst Protection**: Tests rapid request handling
171+
- **User Isolation**: Tests per-user rate limiting
172+
- **Recovery Testing**: Tests limit reset and recovery
173+
174+
## Production Security Checklist
175+
176+
### Environment Configuration
177+
- [ ] JWT_SECRET set to strong, unique value (minimum 32 characters)
178+
- [ ] OPENAI_API_KEY properly configured
179+
- [ ] Database credentials secured
180+
- [ ] ENVIRONMENT set to "production"
181+
- [ ] Security headers enabled
182+
- [ ] Rate limiting enabled
183+
184+
### Network Security
185+
- [ ] HTTPS enforced with valid SSL certificates
186+
- [ ] CORS origins restricted to production domains
187+
- [ ] Firewall rules configured
188+
- [ ] Database access restricted
189+
- [ ] API endpoints not publicly indexed
190+
191+
### Monitoring & Alerting
192+
- [ ] Security event logging enabled
193+
- [ ] Error tracking configured
194+
- [ ] Rate limiting alerts set up
195+
- [ ] Authentication failure monitoring
196+
- [ ] Unusual activity detection
197+
198+
### Data Protection
199+
- [ ] Database encrypted at rest
200+
- [ ] Secure backup procedures
201+
- [ ] PII handling compliance
202+
- [ ] Data retention policies
203+
- [ ] Access logging enabled
204+
205+
## Security Incident Response
206+
207+
### Detection
208+
- **Automated Monitoring**: Real-time security event detection
209+
- **Log Analysis**: Regular log analysis for security events
210+
- **Rate Limit Violations**: Automatic detection of abuse
211+
- **Authentication Anomalies**: Detection of unusual login patterns
212+
213+
### Response Procedures
214+
1. **Immediate Response**: Automatically block suspicious IPs
215+
2. **Investigation**: Analyze security logs and patterns
216+
3. **Mitigation**: Implement additional protective measures
217+
4. **Communication**: Notify relevant stakeholders
218+
5. **Recovery**: Restore normal operations
219+
6. **Post-Incident**: Review and improve security measures
220+
221+
## Security Maintenance
222+
223+
### Regular Updates
224+
- **Dependency Updates**: Regular updates of all dependencies
225+
- **Security Patches**: Prompt application of security patches
226+
- **Configuration Review**: Regular review of security configuration
227+
- **Access Review**: Regular review of user access and permissions
228+
229+
### Security Audits
230+
- **Code Reviews**: Regular security-focused code reviews
231+
- **Penetration Testing**: Periodic penetration testing
232+
- **Vulnerability Scanning**: Regular vulnerability assessments
233+
- **Compliance Checks**: Regular compliance validation
234+
235+
## Security Contact
236+
237+
For security-related issues or vulnerabilities:
238+
- Review security logs in the application
239+
- Check error handling and rate limiting effectiveness
240+
- Validate input sanitization is working correctly
241+
- Ensure all security headers are present
242+
243+
## Implementation Status
244+
245+
✅ **Completed Tasks (Task B28):**
246+
- Authentication and authorization security audit
247+
- Sensitive data handling and environment variable security
248+
- Comprehensive error handling implementation
249+
- Input validation and sanitization system
250+
- Rate limiting and request throttling
251+
- Security headers and CORS configuration
252+
- Security documentation and guidelines
253+
254+
**Security Implementation: COMPLETE**
255+
All security measures have been implemented according to Task B28 requirements.
256+
257+
---
258+
259+
*This document is part of the SmartQuery MVP security implementation and should be regularly updated as new security measures are implemented.*

0 commit comments

Comments
 (0)