OWASP API Security Top 10 Visualised

// GET /v2/orders/:id
app.get('/v2/orders/:id', authenticateToken, async (req, res) => {
  // ❌ No check: does req.user own this order?
  // ❌ Any authenticated user can request any order ID

  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1',
    [req.params.id]
  );

  // ❌ Returns every column, including PII (Personally Identifiable Information)
  res.json(order);
});

app.get('/v2/orders/:id', authenticateToken, async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1',
    [req.params.id]
  );
  if (!order) return res.status(404).json({ error: 'Not found' });

  // ✅ Object-level check: does this order belong to the requester,
  //    or are they the assigned courier / an admin?
  const isOwner = order.customer_id === req.user.id;
  const isCourier = order.courier_id === req.user.id;
  if (!isOwner && !isCourier && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }

  // ✅ Return only a DTO (Data Transfer Object) — never the raw row
  res.json({
    id: order.id,
    status: order.status,
    address: isOwner ? order.delivery_address : undefined,
  });
});

const jwt = require('jsonwebtoken');

function authenticateToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  const decoded = jwt.decode(token, { complete: true });

  // ❌ Trusts the "alg" the token claims, instead of pinning one server-side
  const alg = decoded.header.alg;

  if (alg === 'none') {
    // ❌ "none" means there is no signature at all — accepted anyway
    req.user = decoded.payload;
    return next();
  }

  const verified = jwt.verify(token, SECRET, { algorithms: [alg] });

  // ❌ verified.exp is never checked — a token minted a year ago still works
  req.user = verified;
  next();
}

// POST /auth/login — no rate limiting, no MFA (Multi-Factor Authentication)
app.post('/auth/login', async (req, res) => {
  // ❌ Unlimited attempts per second, from any IP, forever
  const user = await db.findByEmail(req.body.email);
  if (user && await bcrypt.compare(req.body.password, user.hash)) {
    return res.json({ token: signToken(user), expires_in: 3600 });
  }
  res.status(401).json({ error: 'Invalid credentials' });
});

const jwt = require('jsonwebtoken');
const rateLimit = require('express-rate-limit');

function authenticateToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'Missing token' });

  try {
    // ✅ Algorithm is pinned server-side — the token's own header is ignored
    const verified = jwt.verify(token, SECRET, { algorithms: ['HS256'] });
    // ✅ jwt.verify() already rejects an expired "exp" claim by default
    req.user = verified;
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
}

// ✅ Rate limit + lockout on the login route itself
const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });

app.post('/auth/login', loginLimiter, async (req, res) => {
  const user = await db.findByEmail(req.body.email);
  if (!user || !await bcrypt.compare(req.body.password, user.hash)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // ✅ Require a second factor before issuing a full-access token
  if (user.mfaEnabled && !verifyMfaCode(req.body.mfaCode, user)) {
    return res.status(401).json({ error: 'MFA required' });
  }

  res.json({ token: signToken(user, { expiresIn: '15m' }), expires_in: 900 });
});

// GET /api/users/:id/profile
app.get('/api/users/:id/profile', authenticateToken, async (req, res) => {
  const user = await db.users.findById(req.params.id);

  // ❌ Serializes the entire row — every column, no allowlist
  res.json(user);
});

// PATCH /api/users/:id/profile
app.patch('/api/users/:id/profile', authenticateToken, async (req, res) => {
  const user = await db.users.findById(req.params.id);

  // ❌ Mass assignment: every key in req.body is written straight
  //    onto the model, with no check on which fields are editable
  Object.assign(user, req.body);
  await user.save();

  res.json(user);
});

// GET /api/users/:id/profile
app.get('/api/users/:id/profile', authenticateToken, async (req, res) => {
  const user = await db.users.findById(req.params.id);
  if (!user) return res.status(404).json({ error: 'Not found' });

  // ✅ Explicit read allowlist — a DTO (Data Transfer Object), not the raw row
  res.json({
    id: user.id,
    display_name: user.display_name,
    bio: user.bio,
    avatar_url: user.avatar_url,
  });
});

// PATCH /api/users/:id/profile
app.patch('/api/users/:id/profile', authenticateToken, async (req, res) => {
  const user = await db.users.findById(req.params.id);
  if (!user) return res.status(404).json({ error: 'Not found' });

  // ✅ Explicit write allowlist — only these two fields are ever settable,
  //    no matter what else the request body contains
  const { display_name, bio } = req.body;
  if (display_name !== undefined) user.display_name = display_name;
  if (bio !== undefined) user.bio = bio;
  await user.save();

  res.json({ id: user.id, display_name: user.display_name, bio: user.bio });
});

// POST /api/auth/send-otp
app.post('/api/auth/send-otp', async (req, res) => {
  const { phone } = req.body;

  // ❌ No rate limit per phone number or per IP
  // ❌ No CAPTCHA — a script can call this as fast as it likes
  // ❌ No daily cap on how many codes one number can receive

  const otp = generateOtp();
  await redis.set(`otp:${phone}`, otp, 'EX', 300);
  await smsProvider.send(phone, `Your code is ${otp}`); // $0.02/msg

  res.json({ success: true, message: 'OTP sent' });
});

// GET /api/reports/export?from=2015-01-01&to=2026-01-01
app.get('/api/reports/export', authenticateToken, async (req, res) => {
  const { from, to } = req.query;

  // ❌ No limit on date range, no pagination, no max row count
  const rows = await db.query(
    'SELECT * FROM transactions WHERE date BETWEEN $1 AND $2',
    [from, to]
  );

  res.json(rows); // ❌ Serializes the whole result set in one response
});

const otpLimiter = require('./middleware/otpRateLimiter');

app.post('/api/auth/send-otp',
  // ✅ Rate limit by phone number AND by IP, with exponential backoff
  otpLimiter({ keyBy: ['phone', 'ip'], backoff: 'exponential' }),
  // ✅ Require a solved CAPTCHA before an SMS is ever sent
  verifyCaptcha,
  async (req, res) => {
    const { phone } = req.body;

    // ✅ Hard daily cap per phone number, enforced server-side
    const sentToday = await redis.incr(`otp:count:${phone}:${todayKey()}`);
    if (sentToday > 5) {
      return res.status(429).json({ error: 'Daily OTP limit reached' });
    }

    const otp = generateOtp();
    await redis.set(`otp:${phone}`, otp, 'EX', 300);
    await smsProvider.send(phone, `Your code is ${otp}`);

    res.json({ success: true, message: 'OTP sent' });
});

// GET /api/reports/export?from=...&to=...&limit=...&cursor=...
const MAX_PAGE_SIZE = 500;

app.get('/api/reports/export', authenticateToken, async (req, res) => {
  // ✅ Clamp the requested page size — the client never controls the ceiling
  const limit = Math.min(parseInt(req.query.limit) || 100, MAX_PAGE_SIZE);
  const cursor = req.query.cursor || null;

  const rows = await db.query(
    'SELECT * FROM transactions WHERE date BETWEEN $1 AND $2 AND id > $3 ORDER BY id LIMIT $4',
    [req.query.from, req.query.to, cursor, limit]
  );

  res.json({ rows, next_cursor: rows.at(-1)?.id ?? null });
});

// Regular member routes — same router, same base path
app.get('/api/users/:id', authenticateToken, getUser);
app.patch('/api/users/:id', authenticateToken, updateOwnProfile);

// Admin-only routes — the frontend just never renders a button for these
app.delete('/api/admin/users/:id/delete', authenticateToken, deleteUser);
app.get('/api/admin/export-all-users', authenticateToken, exportAllUsers);
app.patch('/api/admin/settings', authenticateToken, updateWorkspaceSettings);

// ❌ authenticateToken only confirms a valid, logged-in session
// ❌ It never checks req.user.role before reaching any /api/admin/* handler
// ❌ Any member, viewer, or contractor account can call these directly

// middleware/requireRole.js
function requireRole(...allowedRoles) {
  return (req, res, next) => {
    if (!allowedRoles.includes(req.user.role)) {
      // ✅ Deny by default — unknown or insufficient role is always a 403
      return res.status(403).json({ error: 'Forbidden' });
    }
    next();
  };
}

// routes/admin.js
const adminRouter = express.Router();

// ✅ Applied once, centrally, to every route on this router — not per-handler
adminRouter.use(authenticateToken, requireRole('admin'));

adminRouter.delete('/users/:id/delete', deleteUser);
adminRouter.get('/export-all-users', exportAllUsers);
adminRouter.patch('/settings', updateWorkspaceSettings);

// ✅ Distinct, consistently-guarded path prefix for every admin function
app.use('/api/admin', adminRouter);

// POST /api/events/:id/tickets/reserve
app.post('/api/events/:id/tickets/reserve', authenticateToken, async (req, res) => {
  // ✅ Requires a real, authenticated account
  // ✅ Validates quantity is a positive integer within the per-order cap
  const { quantity } = req.body;
  if (!Number.isInteger(quantity) || quantity < 1 || quantity > 4) {
    return res.status(400).json({ error: 'Invalid quantity' });
  }

  const event = await db.getEvent(req.params.id);
  // ✅ Confirms real inventory is available before holding seats
  if (event.ticketsAvailable < quantity) {
    return res.status(409).json({ error: 'Not enough tickets available' });
  }

  const reservation = await db.createReservation(req.user.id, event.id, quantity);
  res.json({ reservation_id: reservation.id, status: 'confirmed', hold_expires_in_s: 600 });
});

// POST /api/checkout
app.post('/api/checkout', authenticateToken, async (req, res) => {
  // ✅ Validates the reservation belongs to this account and hasn't expired
  // ✅ Validates the payment method with the processor before confirming
  const reservation = await db.getReservation(req.body.reservation_id);
  if (reservation.account_id !== req.user.id || reservation.expired) {
    return res.status(400).json({ error: 'Invalid or expired reservation' });
  }

  const payment = await paymentProcessor.charge(req.user, reservation.total);
  if (!payment.success) return res.status(402).json({ error: 'Payment declined' });

  await db.finalizeSale(reservation.id);
  res.json({ status: 'purchased' });
});

app.post('/api/events/:id/tickets/reserve', authenticateToken, async (req, res) => {
  // ✅ Purchase velocity: cap reservations per account AND per payment method,
  //    not just per raw HTTP request
  const recent = await velocity.count({
    accountId: req.user.id,
    paymentFingerprint: req.user.savedPaymentFingerprint,
    windowSeconds: 300,
  });
  if (recent.reservations >= 1) {
    return res.status(429).json({ error: 'Purchase limit reached for this sale' });
  }

  // ✅ Device / bot signal: reject headless or fingerprint-farmed clients
  //    specifically on this flow, not just globally
  if (await botSignal.isLikelyAutomated(req.deviceFingerprint)) {
    return res.status(403).json({ error: 'Automated client detected' });
  }

  // ✅ Friction gate: proof-of-work / CAPTCHA in front of THIS step only,
  //    where the abuse actually happens — not sprinkled everywhere
  if (!(await challenge.verify(req.body.challengeToken))) {
    return res.status(403).json({ error: 'Challenge verification failed' });
  }

  // ✅ Fairness under load: route to a virtual waiting room instead of
  //    letting raw request speed decide who wins
  const admitted = await waitingRoom.admit(req.user.id, req.params.id);
  if (!admitted) {
    return res.status(202).json({ status: 'queued', queue_position: admitted.position });
  }

  // ... existing quantity + inventory checks, unchanged ...
});

// POST /api/invoices/:id/export-pdf
app.post('/api/invoices/:id/export-pdf', authenticateToken, async (req, res) => {
  const { logo_url } = req.body;

  // ❌ No allowlist — any URL the client supplies is fetched, as-is
  // ❌ No scheme/host validation, no check against private IP ranges
  // ❌ Redirects are followed by default — the final destination is unchecked
  const logoResponse = await fetch(logo_url);
  const logoBuffer = await logoResponse.arrayBuffer();

  // ❌ Whatever came back — even if it isn't really an image — gets embedded
  const pdf = await renderInvoicePdf(req.params.id, logoBuffer);
  res.contentType('application/pdf').send(pdf);
});

app.post('/api/invoices/:id/export-pdf', authenticateToken, async (req, res) => {
  const { logo_url } = req.body;

  // ✅ Only https:, only hostnames on an explicit allowlist
  const ALLOWED_HOSTS = ['mycompany.com', 'cdn.mycompany.com'];
  let parsed;
  try { parsed = new URL(logo_url); } catch { return res.status(400).json({ error: 'Invalid URL' }); }
  if (parsed.protocol !== 'https:' || !ALLOWED_HOSTS.includes(parsed.hostname)) {
    return res.status(400).json({ error: 'logo_url host is not allowed' });
  }

  // ✅ Resolve DNS ourselves and reject private/link-local/loopback IPs —
  //    checking the hostname alone can't catch DNS rebinding
  const resolvedIp = await resolveHostname(parsed.hostname);
  if (isPrivateOrLinkLocal(resolvedIp)) {
    return res.status(400).json({ error: 'logo_url resolves to a blocked address' });
  }

  // ✅ Fetch by resolved IP, pin the Host header, and never follow redirects
  const logoResponse = await fetch(`https://${resolvedIp}${parsed.pathname}`, {
    redirect: 'manual',
    headers: { Host: parsed.hostname },
  });
  if (logoResponse.status >= 300 && logoResponse.status < 400) {
    return res.status(400).json({ error: 'Redirects are not allowed for logo_url' });
  }
  const logoBuffer = await logoResponse.arrayBuffer();

  const pdf = await renderInvoicePdf(req.params.id, logoBuffer);
  res.contentType('application/pdf').send(pdf);
});

{
  "openapi": "3.0.0",
  "info": { "title": "PetPal API", "version": "2.3.0" },
  "paths": {
    "/v1/pets": { "get": {}, "post": {} },
    "/v1/pets/{id}": { "get": {} },
    "/v1/users/{id}": { "get": {} },
    "/api/internal/debug/reset-db": {
      "post": {
        "summary": "Resets the staging DB to seed data",
        "description": "INTERNAL USE ONLY — do not call in production"
      }
    }
  }
}

// 1. CORS: an explicit allowlist — never a wildcard, never an origin-echo
// ✅ Only these known origins may ever receive a credentialed response
const ALLOWED_ORIGINS = ['https://app.petpal.io', 'https://admin.petpal.io'];
app.use(cors({
  origin(origin, cb) {
    if (!origin || ALLOWED_ORIGINS.includes(origin)) return cb(null, true);
    cb(new Error('Not allowed by CORS'));
  },
  credentials: true,
}));

// 2. API docs: never public in production
// ✅ Swagger UI is gated behind admin auth outside of dev/staging
if (process.env.NODE_ENV === 'production') {
  app.use('/api/swagger.json', requireAdminAuth, swaggerUi.serve);
} else {
  app.use('/api/swagger.json', swaggerUi.serve);
}

// 3. Errors: log full detail server-side, return only a generic message
app.use((err, req, res, next) => {
  // ✅ Full stack trace and DB detail go to the logs, never the response
  const requestId = crypto.randomUUID();
  logger.error({ requestId, err, stack: err.stack });
  res.status(500).json({ error: 'Something went wrong.', requestId });
});

// Deprecation window: v1 returns 410 Gone, but signaled removal in advance
const SUNSET_DATE = 'Wed, 31 Dec 2025 23:59:59 GMT';

app.all('/api/v1/*', (req, res) => {
  // ✅ 410 Gone — distinct from 404, tells clients this is permanent, not missing
  res.set('Sunset', SUNSET_DATE);
  res.set('Deprecation', 'true');
  res.set('Link', '<https://developer.parcelwave.com/docs/v2>; rel="successor-version"');
  return res.status(410).json({
    error: 'This API version was retired on 2025-12-31. Migrate to /api/v2/*.'
  });
});

// Applied to every legacy prefix the inventory audit actually found —
// not just v1. Nothing reachable is left unaccounted for.
app.all(['/api/beta/*', '/api/internal/*'], sameRetirementHandler);

// Our own backend calling a trusted partner's API
async function getRateQuote(order) {
  const resp = await axios.get(
    'https://partner-logistics.example/v1/rate-quote',
    { params: { postcode: order.postcode }, maxRedirects: 5 }
  );
  const quote = resp.data;

  // ❌ Auto-follows any redirect the partner response points to —
  //    no check on where maxRedirects actually took the request
  if (quote.redirect_url) {
    return axios.get(quote.redirect_url);
  }

  // ❌ carrier_name / tracking_url go straight into storage,
  //    no schema validation, no sanitization — "it's from our partner"
  await db.query(
    'UPDATE orders SET carrier_name = $1, tracking_url = $2 WHERE id = $3',
    [quote.carrier_name, quote.tracking_url, order.id]
  );

  // ❌ Rendered straight into an HTML email with no escaping
  const emailHtml = `<p>Shipped via ${quote.carrier_name}.
    Track it here: <a href="${quote.tracking_url}">${quote.tracking_url}</a></p>`;
  return sendEmail(order.customer_email, emailHtml);
}

// Pinned, versioned contract with the partner — never a moving target
const RATE_QUOTE_SCHEMA = z.object({
  carrier_name: z.string().max(64).regex(/^[A-Za-z0-9 &.-]+$/),
  tracking_url: z.string().url(),
  eta_days: z.number().int().min(0).max(30),
});

async function getRateQuote(order) {
  const resp = await axios.get(
    'https://partner-logistics.example/v1/rate-quote',
    { params: { postcode: order.postcode }, maxRedirects: 0, timeout: 3000 }
  );

  // ✅ Validate against a strict schema — reject, don't pass through
  const quote = RATE_QUOTE_SCHEMA.parse(resp.data);

  // ✅ Never auto-follow a partner-supplied redirect; allowlist the host first
  if (!ALLOWED_TRACKING_HOSTS.has(new URL(quote.tracking_url).host)) {
    throw new Error('Untrusted tracking_url host');
  }

  await db.query(
    'UPDATE orders SET carrier_name = $1, tracking_url = $2 WHERE id = $3',
    [quote.carrier_name, quote.tracking_url, order.id]
  );

  // ✅ Escaped before ever reaching HTML, regardless of where it came from
  const emailHtml = `<p>Shipped via ${escapeHtml(quote.carrier_name)}.
    Track it here: <a href="${escapeHtml(quote.tracking_url)}">${escapeHtml(quote.tracking_url)}</a></p>`;
  return sendEmail(order.customer_email, emailHtml);
}