authentication/security

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

JSON-LD XSS vulnerability prevention

JSON.stringify does not sanitize malicious strings used in XSS injection. To prevent XSS vulnerabilities when implementing JSON-LD, scrub HTML tags from the JSON-LD payload by replacing the character '<' with its unicode equivalent '\u003c'. Alternatively, use community-maintained alternatives for JSON.stringify such as serialize-javascript.

Environment variables and .env files security

.env.* files should be added to .gitignore, and only public variables should be prefixed with NEXT_PUBLIC_.

Content Security Policy protects against code injection

A Content Security Policy should be considered to protect a Next.js application against various security threats such as cross-site scripting, clickjacking, and other code injection attacks.

Generate secret key for session signing

Generate a secret key using openssl rand -base64 32 to create a 32-character random string for signing sessions. Store this key as an environment variable called SESSION_SECRET in the .env file.

Encrypt and decrypt sessions with Jose

Use the Jose library with React's 'server-only' package to ensure session management logic only executes on the server. The encrypt function should use SignJWT to create a signed token with algorithm 'HS256', setIssuedAt(), and setExpirationTime('7d'). The decrypt function should use jwtVerify with algorithm 'HS256'.

Cookie security options for session storage

When setting a session cookie, use these recommended options: httpOnly: true (prevents client-side JavaScript from accessing the cookie), secure: true (use https to send the cookie), sameSite: 'lax' (specify whether the cookie can be sent with cross-site requests), expires or max-age (delete the cookie after a certain period), path: '/' (define the URL path for the cookie).

Cookies must be set on the server

Cookies should always be set on the server to prevent client-side tampering. Use the Next.js cookies API to set session cookies with secure options.

Limit user data exposed to client

Expose only what the client needs in getCurrentUser by returning a narrow object like { id, name } rather than the raw session. To keep sensitive fields from reaching the client, use taintUniqueValue to prevent accidentally serializing sensitive data.

Give your agent this brain