Complete security hardening implementation using nuxt-security, authentication patterns, flexible HTTP/HTTPS configuration, and secure development practices.
Built with nuxt-auth-utils for secure session handling:
Implementation: See server/api/auth/login.post.ts for complete JWT session management.
Features:
- ✅ JWT sessions with secure cookies
- ✅ bcrypt password hashing with salt rounds
- ✅ Session encryption using
NUXT_SESSION_PASSWORD - ✅ Automatic session validation
Implementation: See server/api/auth/ routes for bcrypt password hashing and verification patterns.
Implementation: Use useUserSession() composable from nuxt-auth-utils and see server/api/ routes for session management patterns.
Implementation: See server/middleware/auth.global.ts for automatic API route protection.
Protected by default:
- POST, PUT, DELETE operations
- All non-authentication endpoints
Public routes:
- GET operations
/api/auth/*endpoints/api/docs/*(development only)
Client-side route protection:
Implementation:
- Protected routes:
app/middleware/auth.ts - Guest routes:
app/middleware/guest.ts
Configuration: See nuxt.config.ts security headers section for complete CSP implementation with flexible HTTP/HTTPS support.
Environment-specific CORS settings:
Configuration: See nuxt.config.ts corsHandler section for environment-specific CORS settings.
The application supports flexible security configuration for both HTTP (staging) and HTTPS (production) environments:
Key Features:
- ✅ Security headers configured for production environments
- ✅ HSTS enabled only for HTTPS deployments
- ✅ Cross-Origin policies adjusted for protocol
- ✅ CSP upgrade-insecure-requests controlled per environment
Configuration: See nuxt.config.ts security section where headers are conditionally applied.
Production Deployment: Use a reverse proxy (nginx, haproxy, Caddy) to handle HTTPS termination and SSL certificates in production environments.
Configuration: See nuxt.config.ts security headers section for HSTS, XSS protection, and content type options.
Configuration: See nuxt.config.ts rateLimiter section for request limiting configuration.
Implementation: See server/api/ routes for Zod schema validation patterns in API endpoints.
Implementation: See shared/models/ for Zod schemas with security considerations and validation limits.
Configuration: See .env.example for required security environment variables including session password, CORS origins, and HTTPS configuration.
Configuration: See nuxt.config.ts security section for environment-specific security header configurations.
- CSP headers prevent inline script execution
- Input sanitization via Zod validation
- Template escaping automatic in Vue templates
- SameSite cookies with
laxsetting - Origin validation in CORS configuration
- Secure cookie flags in production
- Prisma ORM with parameterized queries
- No raw SQL in application code
- Type-safe database operations
Implementation: See server/api/ routes for secure error response patterns that prevent information disclosure.
Implementation: See server/api/auth/ routes for security event logging patterns.
- JWT session management
- bcrypt password hashing (12 rounds)
- Session encryption
- Automatic session validation
- Route-level protection
- API middleware authentication
- Role-based access (ready for extension)
- Server-side Zod validation
- Client-side form validation
- File upload restrictions (if implemented)
- Content Security Policy
- HSTS (HTTPS enforcement)
- X-Frame-Options (clickjacking)
- X-Content-Type-Options
- CORS configuration
- Rate limiting
- Environment variable security
- Database connection security
- Docker container security