🔒 StudyFlow Security Policy

📋 Table of Contents

✅ Supported Versions

🛡️ Security Features (v2.0)

1. Authentication System

// Backend/middleware/auth.middleware.js
const jwt = require('jsonwebtoken');
const authMiddleware = (req, res, next) => {
 const token = req.headers.authorization?.split(' ')[1];
 
 if (!token) {
 return res.status(401).json({ error: 'Authentication required' });
 }
 
 try {
 const decoded = jwt.verify(token, process.env.JWT_SECRET);
 req.userId = decoded.id;
 next();
 } catch (error) {
 return res.status(401).json({ error: 'Invalid or expired token' });
 }
};

2. Input Validation & Sanitization

// Backend/routes/auth.routes.js
const { body, validationResult } = require('express-validator');
router.post('/register', [
 body('email').isEmail().normalizeEmail(),
 body('password').isLength({ min: 8 }).isStrongPassword(),
 body('username').trim().isLength({ min: 3, max: 30 })
 .matches(/^[a-zA-Z0-9_]+$/)
], async (req, res) => {
 const errors = validationResult(req);
 if (!errors.isEmpty()) {
 return res.status(400).json({ errors: errors.array() });
 }
 // Process registration...
});

3. Rate Limiting

// Backend/server.js
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
 windowMs: 15 * 60 * 1000, // 15 minutes
 max: 100, // Max 100 requests per window
 message: 'Too many requests, please try again later.'
});
const authLimiter = rateLimit({
 windowMs: 15 * 60 * 1000,
 max: 5, // Max 5 login attempts per 15 minutes
 skipSuccessfulRequests: true
});
app.use('/api/', limiter);
app.use('/api/auth/login', authLimiter);

4. CORS Configuration

// Backend/server.js
const cors = require('cors');
app.use(cors({
 origin: process.env.FRONTEND_URL || 'https://studyflow.salahuddin.codes',
 credentials: true,
 methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
 allowedHeaders: ['Content-Type', 'Authorization']
}));

5. Environment Variables

# Never commit this file!
JWT_SECRET=your_super_secret_jwt_key_here_change_this
MONGO_URI=mongodb://localhost:27017/studyflow
BREVO_API_KEY=your_brevo_api_key
EMAIL_FROM=noreply@studyflow.com
FRONTEND_URL=https://studyflow.salahuddin.codes
NODE_ENV=production

🔐 Authentication & Authorization

Authentication Flow

Client Server Database
 │ │ │
 │──── POST /auth/register ────>│ │
 │ (email, password) │ │
 │ │─── Hash Password ─────────>│
 │ │ (bcrypt, 12 rounds) │
 │ │<─── Store User ────────────│
 │ │ │
 │<─── JWT Token ───────────────│ │
 │ (24h expiration) │ │
 │ │ │
 │──── GET /api/user/profile ──>│ │
 │ Authorization: Bearer │ │
 │ │─── Verify Token ──────────>│
 │ │<─── User Data ─────────────│
 │<─── User Profile ────────────│ │

Authorization Middleware

// Backend/middleware/admin.middleware.js
const adminMiddleware = (req, res, next) => {
 if (req.user.role !== 'admin') {
 return res.status(403).json({ 
 error: 'Access denied. Admin privileges required.' 
 });
 }
 next();
};
// Usage
router.delete('/api/admin/users/:id', 
 authMiddleware, 
 adminMiddleware, 
 adminController.deleteUser
);

// Ensure users can only access their own data
const ownershipMiddleware = (req, res, next) => {
 const resourceUserId = req.params.userId || req.body.userId;
 
 if (resourceUserId !== req.userId) {
 return res.status(403).json({ 
 error: 'Access denied. You can only access your own resources.' 
 });
 }
 next();
};

🗄️ Data Protection

Database Security

Data Encryption

// Backend/models/User.js
const crypto = require('crypto');
userSchema.methods.encryptSensitiveData = function(data) {
 const cipher = crypto.createCipher('aes-256-cbc', process.env.ENCRYPTION_KEY);
 let encrypted = cipher.update(data, 'utf8', 'hex');
 encrypted += cipher.final('hex');
 return encrypted;
};
userSchema.methods.decryptSensitiveData = function(encrypted) {
 const decipher = crypto.createDecipher('aes-256-cbc', process.env.ENCRYPTION_KEY);
 let decrypted = decipher.update(encrypted, 'hex', 'utf8');
 decrypted += decipher.final('utf8');
 return decrypted;
};

Data Retention & Privacy

// Anonymize user data for analytics
const anonymizedData = {
 userId: crypto.createHash('sha256').update(user._id.toString()).digest('hex'),
 totalSessions: user.totalSessions,
 // No PII included
};

🔒 API Security

Secure Headers

// Backend/server.js
const helmet = require('helmet');
app.use(helmet({
 contentSecurityPolicy: {
 directives: {
 defaultSrc: ["'self'"],
 styleSrc: ["'self'", "'unsafe-inline'"],
 scriptSrc: ["'self'"],
 imgSrc: ["'self'", "data:", "https:"],
 },
 },
 hsts: {
 maxAge: 31536000,
 includeSubDomains: true,
 preload: true
 },
 referrerPolicy: { policy: 'strict-origin-when-cross-origin' }
}));

Request Validation

// Backend/validators/taskValidator.js
const taskSchema = {
 title: {
 type: 'string',
 minLength: 1,
 maxLength: 200,
 required: true
 },
 subject: {
 type: 'string',
 pattern: '^[a-zA-Z0-9 ]+$'
 },
 priority: {
 type: 'string',
 enum: ['low', 'medium', 'high']
 }
};

API Key Management

🚀 v2.5 Security Enhancements

1. WebSocket Security

// Backend/websocket/socketAuth.js
const socketAuth = (socket, next) => {
 const token = socket.handshake.auth.token;
 
 try {
 const decoded = jwt.verify(token, process.env.JWT_SECRET);
 socket.userId = decoded.id;
 socket.userRole = decoded.role;
 next();
 } catch (error) {
 next(new Error('Authentication failed'));
 }
};
io.use(socketAuth);

// Verify user is member of study group before joining room
socket.on('joinRoom', async (roomId) => {
 const isMember = await Group.exists({
 _id: roomId,
 'members.userId': socket.userId
 });
 
 if (!isMember) {
 socket.emit('error', { message: 'Access denied to this room' });
 return;
 }
 
 socket.join(roomId);
});

// Sanitize and validate all incoming messages
socket.on('sendMessage', async (data) => {
 // Validate message format
 if (!data.message || typeof data.message !== 'string') {
 return socket.emit('error', { message: 'Invalid message format' });
 }
 
 // Sanitize HTML
 const sanitizedMessage = DOMPurify.sanitize(data.message);
 
 // Rate limiting (max 10 messages per minute)
 const messageCount = await redis.incr(`msg_count:${socket.userId}`);
 await redis.expire(`msg_count:${socket.userId}`, 60);
 
 if (messageCount > 10) {
 return socket.emit('error', { message: 'Rate limit exceeded' });
 }
 
 // Broadcast message
 io.to(data.roomId).emit('newMessage', {
 userId: socket.userId,
 message: sanitizedMessage,
 timestamp: Date.now()
 });
});

2. Redis Security

// Backend/config/redis.js
const redis = require('redis');
const client = redis.createClient({
 host: process.env.REDIS_HOST,
 port: process.env.REDIS_PORT,
 password: process.env.REDIS_PASSWORD,
 tls: process.env.NODE_ENV === 'production' ? {} : undefined,
 db: 0
});
// Enable ACL (Access Control Lists)
// Only allow specific commands for each connection type

// Encrypt sensitive data before caching
const cacheUserData = async (userId, data) => {
 const encrypted = encrypt(JSON.stringify(data));
 await redis.set(`user:${userId}`, encrypted, 'EX', 3600);
};
const getCachedUserData = async (userId) => {
 const encrypted = await redis.get(`user:${userId}`);
 if (!encrypted) return null;
 return JSON.parse(decrypt(encrypted));
};

3. File Upload Security

// Backend/middleware/fileUpload.js
const multer = require('multer');
const path = require('path');
const upload = multer({
 limits: {
 fileSize: 5 * 1024 * 1024, // 5MB max
 },
 fileFilter: (req, file, cb) => {
 // Allow only specific file types
 const allowedTypes = /jpeg|jpg|png|pdf|docx/;
 const extname = allowedTypes.test(
 path.extname(file.originalname).toLowerCase()
 );
 const mimetype = allowedTypes.test(file.mimetype);
 
 if (extname && mimetype) {
 return cb(null, true);
 }
 cb(new Error('Invalid file type'));
 }
});
// Virus scanning (ClamAV integration)
const scanFile = async (fileBuffer) => {
 const NodeClam = require('clamscan');
 const clamscan = await new NodeClam().init();
 const { isInfected } = await clamscan.scanBuffer(fileBuffer);
 return !isInfected;
};
router.post('/upload', upload.single('file'), async (req, res) => {
 // Scan file for viruses
 const safe = await scanFile(req.file.buffer);
 if (!safe) {
 return res.status(400).json({ error: 'File contains malware' });
 }
 
 // Upload to Cloudinary
 const result = await cloudinary.uploader.upload(req.file.path, {
 folder: 'studyflow/notes',
 resource_type: 'auto',
 access_control: [{ access_type: 'token' }]
 });
 
 res.json({ url: result.secure_url });
});

4. Enhanced Logging & Monitoring

// Backend/models/AuditLog.js
const auditLogSchema = new mongoose.Schema({
 userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
 action: { 
 type: String, 
 enum: ['login', 'logout', 'data_export', 'data_delete', 'settings_change']
 },
 ipAddress: String,
 userAgent: String,
 metadata: mongoose.Schema.Types.Mixed,
 timestamp: { type: Date, default: Date.now }
});
// Middleware to log all sensitive operations
const auditMiddleware = (action) => async (req, res, next) => {
 req.on('finish', async () => {
 await AuditLog.create({
 userId: req.userId,
 action: action,
 ipAddress: req.ip,
 userAgent: req.get('user-agent'),
 metadata: {
 method: req.method,
 path: req.path,
 statusCode: res.statusCode
 }
 });
 });
 next();
};

// Backend/services/securityMonitor.js
const monitor = {
 // Detect suspicious login patterns
 checkSuspiciousLogin: async (userId, ipAddress) => {
 const recentLogins = await AuditLog.find({
 userId,
 action: 'login',
 timestamp: { $gte: Date.now() - 3600000 } // Last hour
 });
 
 const uniqueIPs = new Set(recentLogins.map(log => log.ipAddress));
 
 // Alert if multiple IPs in short time
 if (uniqueIPs.size > 3) {
 await sendSecurityAlert(userId, 'Multiple login locations detected');
 }
 },
 
 // Detect brute force attempts
 checkBruteForce: async (ipAddress) => {
 const failedAttempts = await redis.get(`failed_login:${ipAddress}`);
 if (failedAttempts > 10) {
 // Block IP temporarily
 await redis.set(`blocked_ip:${ipAddress}`, '1', 'EX', 3600);
 return true;
 }
 return false;
 }
};

5. Two-Factor Authentication (2FA)

// Backend/utils/2fa.js
const speakeasy = require('speakeasy');
const QRCode = require('qrcode');
const enable2FA = async (userId) => {
 const secret = speakeasy.generateSecret({
 name: `StudyFlow (${user.email})`
 });
 
 const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
 
 // Save secret to user (encrypted)
 await User.findByIdAndUpdate(userId, {
 'twoFA.secret': encrypt(secret.base32),
 'twoFA.enabled': false // Enable after verification
 });
 
 return { qrCodeUrl, secret: secret.base32 };
};
const verify2FA = (secret, token) => {
 return speakeasy.totp.verify({
 secret: decrypt(secret),
 encoding: 'base32',
 token: token,
 window: 2 // Allow 2 time steps for clock drift
 });
};

6. Content Security Policy (CSP)

// More strict CSP with nonce-based script loading
app.use((req, res, next) => {
 const nonce = crypto.randomBytes(16).toString('base64');
 res.locals.nonce = nonce;
 
 res.setHeader('Content-Security-Policy', `
 default-src 'self';
 script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net;
 style-src 'self' 'unsafe-inline';
 img-src 'self' data: https://res.cloudinary.com;
 connect-src 'self' wss://studyflow.salahuddin.codes;
 font-src 'self' data:;
 frame-src 'none';
 object-src 'none';
 `.replace(/\s{2,}/g, ' ').trim());
 
 next();
});

🚨 Reporting a Vulnerability

How to Report

What to Include

Our Commitment

Hall of Fame

📘 Security Best Practices

For Developers

For Users

✅ Compliance

Standards & Regulations

Security Certifications