Feat/security hardening middleware suite

backend/.env.example

@@ -0,0 +1,18 @@
+# ======================== REQUIRED VARIABLES ========================
+# Server Configuration (REQUIRED)
+PORT=5000
+NODE_ENV=development
+
+# Database (REQUIRED)
+MONGO_URI=mongodb://localhost:27017/github_tracker
+
+# Security (REQUIRED)
+SESSION_SECRET=your-super-secret-random-key-change-in-production
+CLIENT_URL=http://localhost:5173
+
+# ======================== OPTIONAL VARIABLES ========================
+# Cookie Configuration (Optional - uses localhost if not set)
+COOKIE_DOMAIN=localhost
+
+# Logging (Optional - defaults to 'info' in production, 'debug' in development)
+LOG_LEVEL=debug

backend/middleware/auth.js

@@ -0,0 +1,11 @@
+const requireAuth = (req, res, next) => {
+    if (!req.isAuthenticated()) {
+        return res.status(401).json({
+            success: false,
+            message: 'Authentication required'
+        });
+    }
+    next();
+};
+
+module.exports = { requireAuth };

backend/middleware/envValidator.js

@@ -0,0 +1,22 @@
+const logger = require('../logger');
+
+const validateEnv = () => {
+    const requiredVars = [
+        'MONGO_URI',
+        'PORT',
+        'SESSION_SECRET',
+        'CLIENT_URL',
+        'NODE_ENV',
+    ];
+
+    const missingVars = requiredVars.filter(v => !process.env[v]);
+
+    if (missingVars.length > 0) {
+        logger.error(`Missing required environment variables: ${missingVars.join(', ')}`);
+        process.exit(1);
+    }
+
+    logger.info('Environment variables validated ✓');
+};
+
+module.exports = { validateEnv };

backend/middleware/errorHandler.js

@@ -0,0 +1,22 @@
+const logger = require('../logger');
+
+const errorHandler = (err, req, res, next) => {
+    const status = err.status || err.statusCode || 500;
+    const message = process.env.NODE_ENV === 'production'
+        ? 'Internal Server Error'
+        : err.message;
+
+    logger.error(`[${req.method} ${req.path}] Error: ${err.message}`, err);
+
+    res.status(status).json({
+        success: false,
+        message,
+        ...(process.env.NODE_ENV !== 'production' && { stack: err.stack }),
+    });
+};
+
+const asyncHandler = (fn) => (req, res, next) => {
+    Promise.resolve(fn(req, res, next)).catch(next);
+};
+
+module.exports = { errorHandler, asyncHandler };

backend/middleware/logger.js

@@ -0,0 +1,13 @@
+const morgan = require('morgan');
+const logger = require('../logger');
+
+const morganStream = {
+    write: (message) => logger.info(message.trim()),
+};
+
+const httpLogger = morgan(
+    ':remote-addr - :remote-user [:date[clf]] ":method :url HTTP/:http-version" :status :res[content-length] ":referrer" ":user-agent" - :response-time ms',
+    { stream: morganStream }
+);
+
+module.exports = httpLogger;

backend/middleware/security.js

@@ -0,0 +1,24 @@
+const helmet = require('helmet');
+
+const securityHeaders = helmet({
+    contentSecurityPolicy: {
+        directives: {
+            defaultSrc: ["'self'"],
+            styleSrc: ["'self'", "'nonce-randomvalue'"],
+            scriptSrc: ["'self'"],
+            imgSrc: ["'self'", 'data:', 'https://api.github.com', 'https://avatars.githubusercontent.com'],
+            connectSrc: ["'self'", 'https://api.github.com'],
+            fontSrc: ["'self'", 'https://fonts.googleapis.com'],
+        },
+    },
+    hsts: {
+        maxAge: 31536000, // 1 year
+        includeSubDomains: true,
+        preload: true,
+    },
+    frameguard: { action: 'deny' },
+    noSniff: true,
+    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+});
+
+module.exports = securityHeaders;

backend/package.json

@@ -14,11 +14,15 @@
   "dependencies": {
     "bcryptjs": "^2.4.3",
     "body-parser": "^1.20.3",
+    "connect-mongo": "^6.0.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.21.1",
+    "express-rate-limit": "^8.5.2",
     "express-session": "^1.18.1",
+    "helmet": "^8.2.0",
     "mongoose": "^8.8.2",
+    "morgan": "^1.10.1",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
     "winston": "^3.19.0",

backend/routes/auth.js

@@ -3,48 +3,84 @@ const passport = require("passport");
 const User = require("../models/User");
 const { signupSchema, loginSchema } = require("../validators/authValidator");
 const { validateRequest } = require("../validators/validationRequest");
+const { asyncHandler } = require("../middleware/errorHandler");
+const { requireAuth } = require("../middleware/auth");
+const { success, email } = require("zod");
 const router = express.Router();
 
 // Signup route
-router.post("/signup", validateRequest(signupSchema), async (req, res) => {
+router.post("/signup", validateRequest(signupSchema), asyncHandler(async (req, res) => {
 
-    const { username,  email, password } = req.body;
+    const { username, email, password } = req.body;
 
-    try {
-        const existingUser = await User.findOne({
-            $or: [{ email }, { username }],
-        });
-
-        if (existingUser)
-            return res.status(400).json({ message: 'User already exists' });
+    const existingUser = await User.findOne({
+        $or: [{ email }, { username }],
+    });
 
-        const newUser = new User({ username, email, password });
-        await newUser.save();
-        res.status(201).json({ message: 'User created successfully' });
-    } catch (err) {
-        if (err && err.code === 11000) {
-            return res.status(400).json({ message: 'User already exists' });
-        }
+    if (existingUser)
+        return res.status(400).json({
+        success: false,
+        message: 'User already exists' 
+    });
 
-        res.status(500).json({ message: 'Error creating user', error: err.message });
-    }
-});
+    const newUser = new User({ username, email, password });
+    await newUser.save();
+    res.status(201).json({
+        success: true,
+        message: 'User created successfully' });
+}));
 
 // Login route
-router.post("/login", validateRequest(loginSchema), passport.authenticate('local'), (req, res) => {
-    res.status(200).json( { message: 'Login successful', user: req.user } );
+router.post("/login", validateRequest(loginSchema), (req, res, next) => {
+    passport.authenticate('local', (err, user, info) => {
+        if (err) return next(err);
+        if (!user) return res.status(401).json({
+            success: false,
+            message: 'Invalid email or password'
+        });
+
+        req.session.regenerate((regenerateErr) => {
+            if (regenerateErr) return next(regenerateErr);
+
+            req.logIn(user, (loginErr) => {
+                if (loginErr) return next(loginErr);
+                res.status(200).json({
+                    success: true,
+                    message: 'Login successful',
+                    user: { id: user.id, username: user.username, email: user.email }
+                });
+            });
+        });
+    })(req, res, next);
 });
 
-// Logout route
-router.get("/logout", (req, res) => {
+// Logout route with authentication check
+router.get("/logout", requireAuth, asyncHandler(async (req, res) => {
 
     req.logout((err) => {
+        if (err) {
+            return res.status(500).json({
+                success: false,
+                message: 'Logout failed'
+            });
+        }
+        res.status(200).json({
+            success: true,
+            message: 'Logged out successfully'
+        });
+    });
+}));
 
-        if (err)
-            return res.status(500).json({ message: 'Logout failed', error: err.message });
-        else
-            res.status(200).json({ message: 'Logged out successfully' });
+// Get current user route with authentication check
+router.get("/me", requireAuth, asyncHandler(async (req, res) => {
+    res.status(200).json({
+        success: true,
+        user: {
+            id: req.user.id,
+            username: req.user.username,
+            email: req.user.email,
+        },
     });
-});
+}));
 
 module.exports = router;

backend/server.js

@@ -1,18 +1,31 @@
 const express = require('express');
 const mongoose = require('mongoose');
 const session = require('express-session');
+const MongoStore = require('connect-mongo').default;
 const passport = require('passport');
 const bodyParser = require('body-parser');
+const rateLimit = require('express-rate-limit');
 require('dotenv').config();
 const cors = require('cors');
 
 // Passport configuration
 require('./config/passportConfig');
 
 const logger = require('./logger');
+const securityHeaders = require('./middleware/security');
+const { validateEnv } = require('./middleware/envValidator');
+const httpLogger = require('./middleware/logger');
+const { errorHandler } = require('./middleware/errorHandler');
+const { requireAuth } = require('./middleware/auth');
+
+// Validate environment variables
+validateEnv();
 
 const app = express();
 
+app.use(securityHeaders);
+app.use(httpLogger);
+
 // CORS configuration
 const allowedOrigins = ['http://localhost:5173', 'https://github-spy.etlify.app'];
 app.use(cors({
@@ -27,27 +40,94 @@ app.use(cors({
 }));
 
 // Middleware
-app.use(bodyParser.json());
+app.use(bodyParser.json({ limit: '10mb' }));
+app.use(bodyParser.urlencoded({ limit: '10mb', extended: true }));
+
 app.use(session({
     secret: process.env.SESSION_SECRET,
     resave: false,
     saveUninitialized: false,
+    store: MongoStore.create({
+        mongoUrl: process.env.MONGO_URI,
+        touchAfter: 24 * 3600,
+    }),
+    cookie: {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'strict',
+        maxAge: 1000 * 60 * 30,
+        domain: process.env.COOKIE_DOMAIN || undefined,
+    }
 }));
+
 app.use(passport.initialize());
 app.use(passport.session());
 
+// Rate Limiting
+const authLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: 10,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { message: 'Too many attempts, please try again after 15 minutes.' },
+    skipSuccessfulRequests: true,
+    // keyGenerator: (req) => req.ip, // Rate limit by IP address
+});
+
+// General API: 100 requests per 15 minutes
+const generalLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: 100,
+    standardHeaders: true,
+    legacyHeaders: false,
+    skip: (req) => req.isAuthenticated(), // Skip rate limiting for authenticated users
+})
+
+app.use('/api/auth', authLimiter);
+app.use('/api', generalLimiter);
+
+// Health Check
+app.get('/api/health', (req,res) => {
+    res.status(200).json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
 // Routes
 const authRoutes = require('./routes/auth');
+
 app.use('/api/auth', authRoutes);
 
+
+// 404 Handler
+app.use((req, res) => {
+    res.status(404).json({ success: false, message: 'Route not found' });
+});
+
+// Global Error Handler
+app.use(errorHandler);
+
+module.exports = app;
+
 // Connect to MongoDB
-mongoose.connect(process.env.MONGO_URI, {}).then(() => {
+mongoose.connect(process.env.MONGO_URI, {
+    maxPoolSize: 10,
+    minPoolSize: 5,
+    waitQueueTimeoutMS: 10000,
+}).then(() => {
     logger.info('Connected to MongoDB');
-
-    const PORT = process.env.PORT || 5000;
-    app.listen(PORT, () => {
-        logger.info(`Server running on port ${PORT}`);
+    app.listen(process.env.PORT, () => {
+        logger.info(`Server running on port ${process.env.PORT}`);
+        logger.info(`✓ Environment: ${process.env.NODE_ENV}`);
     });
 }).catch((err) => {
     logger.error('MongoDB connection error', err);
+    process.exit(1);
 });
+
+// Graceful shutdown
+process.on('SIGTERM', () => {
+    logger.info('SIGTERM received, shutting down gracefully');
+    mongoose.connection.close(false, () => {
+        logger.info('MongoDB connection closed');
+        process.exit(0);
+    })
+})