Skip to content

AUDIT.md

Latest commit

 

History

History
137 lines (96 loc) · 3.57 KB

AUDIT.md

File metadata and controls

137 lines (96 loc) · 3.57 KB
Raw

AuthKit Security Audit Documentation

🛡️ Security Audit Script

The scripts/security-audit.js script performs comprehensive security checks on your AuthKit API according to your exact specifications.

📋 Audit Checks

1. httpOnly Cookie Check

What it checks: Verifies that the /api/refresh route sets httpOnly: true for refresh token cookies.

Pass: ✅ Refresh token cookie has httpOnly protection
Fail: ❌ Critical: Refresh token cookie missing httpOnly! [FIX: npm run fix]

2. JWT Expiration Check

What it checks: Ensures JWT_EXPIRATION is not longer than 1800 seconds (30 minutes).

Pass: ✅ JWT expiration is 900 seconds (within 30 min limit)
Warn: ⚠️ Warn: JWT expiration too long (30+ mins). Reduce to 15 mins.

3. API Route Protection Check

What it checks: Verifies that /api/me route exists and has authentication middleware.

Pass: ✅ /api/me route is properly protected with auth middleware
Fail: ❌ Critical: Unprotected route! [FIX: Add auth middleware]

🔧 Auto-Fix Functionality

npm run fix

The npm run fix command automatically fixes common security issues:

  1. httpOnly Cookie Fix

    • Adds httpOnly: true to refresh token cookies
    • Modifies backend/routes/auth.js

  2. JWT Expiration Fix

    • Sets JWT_EXPIRATION=900 (15 minutes) in .env file
    • Adds the setting if it doesn't exist

📊 Exit Codes

  • Exit Code 0: All security checks passed ✅
  • Exit Code 1: Critical security issues found ❌

🚀 Usage

Run Security Audit

npm run audit

Auto-Fix Issues

npm run fix

Manual Fix

node scripts/security-audit.js --fix

📝 Example Output

✅ All Checks Pass

🛡️ AuthKit Security Audit

✅ Refresh token cookie has httpOnly protection
✅ JWT expiration is 900 seconds (within 30 min limit)
✅ /api/me route is properly protected with auth middleware

✅ Security audit passed!

❌ Issues Found

🛡️ AuthKit Security Audit

❌ Critical: Refresh token cookie missing httpOnly! [FIX: npm run fix]
⚠️ Warn: JWT expiration too long (30+ mins). Reduce to 15 mins.
✅ /api/me route is properly protected with auth middleware

❌ Security audit failed - issues found!

🔧 Auto-Fix in Action

🛡️ AuthKit Security Audit

✅ Refresh token cookie has httpOnly protection
✅ JWT expiration is 900 seconds (within 30 min limit)
✅ /api/me route is properly protected with auth middleware

🔧 Auto-fixing issues...
✅ Fixed: Set JWT expiration to 900 seconds (15 mins)

✅ Security audit passed!

🔍 Technical Details

Files Checked

  • backend/routes/auth.js - Refresh token route and cookie configuration
  • backend/middleware/cookieAuth.js - Cookie security middleware
  • backend/routes/user.js - API route protection
  • .env - JWT expiration configuration

Regex Patterns Used

  • Refresh route: /router\.post\s*\(\s*['"]/refresh['"]/gi
  • httpOnly cookie: /httpOnly:\s*true/gi
  • Secure cookie function: /setSecureRefreshTokenCookie/gi
  • /me route: /router\.get\s*\(\s*['"]/me['"]/gi
  • Auth middleware: /authenticateToken/gi

🛠️ Integration with CI/CD

Add to your CI/CD pipeline:

# GitHub Actions example
- name: Security Audit
  run: npm run audit
  
# This will fail the build if security issues are found

📈 Security Score

Current AuthKit security status:

  • 3/3 checks passing ✅
  • 0 critical issues ✅
  • 0 warnings ✅
  • Exit code: 0 ✅

🔒 Your AuthKit API is secure and ready for production!