Auth Security Headers — Security Headers for Authentication Endpoints

// Security headers middleware for auth routes
function authSecurityHeaders(req, res, next) {
  // HSTS - enforce HTTPS
  res.setHeader('Strict-Transport-Security',
    'max-age=31536000; includeSubDomains; preload');

  // Prevent clickjacking on login pages
  res.setHeader('X-Frame-Options', 'DENY');

  // CSP for login page
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    "script-src 'self' 'nonce-" + generateNonce() + "'",
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "form-action 'self'",
    "base-uri 'self'",
    "frame-ancestors 'none'"
  ].join('; '));

  // Prevent MIME type sniffing
  res.setHeader('X-Content-Type-Options', 'nosniff');

  // Referrer policy for auth pages
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');

  // Permissions policy
  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');

  // CSRF protection
  const csrfToken = crypto.randomBytes(32).toString('hex');
  req.session.csrfToken = csrfToken;
  res.setHeader('X-CSRF-Token', csrfToken);

  next();
}

// CSRF validation for auth endpoints
function validateCSRF(req, res, next) {
  if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
    const token = req.headers['x-csrf-token'];
    if (!token || token !== req.session.csrfToken) {
      return res.status(403).json({ error: 'CSRF token validation failed' });
    }
  }
  next();
}

app.use('/auth', authSecurityHeaders);
app.post('/auth/login', validateCSRF, loginHandler);