Security Hardening

User Stories

As a security-conscious operator, I want HTTP security headers on every response, so that browsers enforce content restrictions and prevent clickjacking #TBD
As a developer, I want the one raw SQL call replaced with a safe parameterized query, so that the codebase has zero use of $executeRawUnsafe #TBD
As a developer, I want dangerouslySetInnerHTML usage audited, so that no user-controlled content is ever rendered as raw HTML #TBD
As a developer, I want GoLink destination URLs validated on write, so that javascript: or data: URIs cannot be stored and served to users #TBD
As a security-conscious operator, I want rate limiting on public mutation endpoints, so that the site cannot be spammed or brute-forced #TBD
As a developer, I want file uploads to validate MIME type server-side, so that malicious files cannot be uploaded by forging a Content-Type header #TBD

Technical Requirements

Add headers() export to next.config.js with CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Replace prisma.$executeRawUnsafe in alumni-requests/route.ts with prisma.$executeRaw tagged template
Audit and document dangerouslySetInnerHTML on about/primary-officers-policy and about/constitution pages
Add URL scheme validation to golinks POST and PUT handlers
Implement rate limiting middleware for public endpoints
Replace contentType.startsWith("image/") check with an explicit MIME allowlist in aws upload routes

Design Considerations

CSP header must allow Google OAuth redirect domains and AWS S3 image domains already in next.config.js remotePatterns
Rate limiting should use IP + endpoint as the key; consider Upstash Redis for distributed deployments
HSTS should only be set if the site is served exclusively over HTTPS in production

Epic 1 (#331) and Epic 2 (#340) should be in progress before tackling this epic
GoLink URL validation in this epic should be coordinated with GoLink Zod schema in #341

Design Documents

Security findings documented in plan: auth_&_validation_epics_af68b015.plan.md

# Security Hardening ## User Stories - [ ] As a security-conscious operator, I want HTTP security headers on every response, so that browsers enforce content restrictions and prevent clickjacking #TBD - [ ] As a developer, I want the one raw SQL call replaced with a safe parameterized query, so that the codebase has zero use of $executeRawUnsafe #TBD - [ ] As a developer, I want dangerouslySetInnerHTML usage audited, so that no user-controlled content is ever rendered as raw HTML #TBD - [ ] As a developer, I want GoLink destination URLs validated on write, so that javascript: or data: URIs cannot be stored and served to users #TBD - [ ] As a security-conscious operator, I want rate limiting on public mutation endpoints, so that the site cannot be spammed or brute-forced #TBD - [ ] As a developer, I want file uploads to validate MIME type server-side, so that malicious files cannot be uploaded by forging a Content-Type header #TBD ## Technical Requirements - [ ] Add headers() export to next.config.js with CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - [ ] Replace prisma.$executeRawUnsafe in alumni-requests/route.ts with prisma.$executeRaw tagged template - [ ] Audit and document dangerouslySetInnerHTML on about/primary-officers-policy and about/constitution pages - [ ] Add URL scheme validation to golinks POST and PUT handlers - [ ] Implement rate limiting middleware for public endpoints - [ ] Replace contentType.startsWith("image/") check with an explicit MIME allowlist in aws upload routes ## Design Considerations - [ ] CSP header must allow Google OAuth redirect domains and AWS S3 image domains already in next.config.js remotePatterns - [ ] Rate limiting should use IP + endpoint as the key; consider Upstash Redis for distributed deployments - [ ] HSTS should only be set if the site is served exclusively over HTTPS in production ## Dependencies - [ ] Epic 1 (#331) and Epic 2 (#340) should be in progress before tackling this epic - [ ] GoLink URL validation in this epic should be coordinated with GoLink Zod schema in #341 ## Design Documents - Security findings documented in plan: auth_&_validation_epics_af68b015.plan.md

Rows
Columns

Epic: Security Hardening #346

Security Hardening

User Stories

Technical Requirements

Design Considerations

Dependencies

Design Documents