feat: YL-36-BackSecuring-CSRFToken

[C-Alexis4414]

WHAT

Middleware CSRF, Rate-Limit, and Cookie-Parser were added with creation of the security module and controller.

WHY

For enforcing security against cross-site request forgery attacks, brute force attacks and abuse.

HOW

Nature of CSRF Token
A CSRF token is a temporary token generated for each user or request session, and it is stored in a cookie or sent in the request header. The server simply checks whether the token received corresponds to the one generated for the current user session.

1. Installation of dependencies

# express-rate-limit for limiting the number of requests from a user or IP address during a given period, useful to prevent brute force attacks or abuse
npm i express-rate-limit
# Middleware cookie-parser for managing cookies used to store CSRF tokens
npm i cookie-parser
# csurf middleware, provided by the Nest.js community, for CSRF token integration
npm i csurf

2. CSRF Configuration in the application
   Recommended middleware order :
   a) RateLimitMiddleware -> To limit abusive requests first .
   b) cookie-parser -> To analyze cookies and make them available in the req object.
   c) csurf -> To protect against CSRF attacks, using already parsed cookies.

3. csrf error handling
   Custom exception filter in case of 403 error (invalid CSRF token) created in csrf-exception.filter.ts file.
   This filter has added globally in main.ts file.

4. Creating a route to get the CSRF token
   Added a route to return the CSRF token that can be used by the frontend to protect its requests.

5. Creation of the security module
   Added a security.module.ts file.
   Create the rate limiter instance (rateLimiter) before the method configure to ensure it is properly initialized at application start.
   Then, in the configure method, we apply the rateLimiter instance as middleware first, followed by cookie-parser and csurf.
   Importation of the security module in the app.module.ts file.

6. For the tests
   To test with Swagger UI, change OpenAPI* file in main.ts.

(*) Ability to export the OpenAPI file via http://localhost:3000/api-json or http://localhost:3000/api-yaml, to import the query collection into Insomnia.

Link to Jira ticket

BackSecuring-CSRFTokens

Checklist

• Tested
• Documented or commented
• Search for duplicates code or PRs or issues
• Blocked
• WIP

---

Blocked

N/A

WIP

N/A

Resources

Medium article :
Best Security implementation Practices In NestJS. A Comprehensive Guide
Dev.to article :
Best Security implementation Practices In NestJS. A Comprehensive Guide

┆Issue is synchronized with this Jira Task by Unito

[C-Alexis4414]

Implementation of user sessions to complement good security practices.
YL-48 User-Session

[accardigianni]

Approve

[accardigianni]

approve