swadhin / justapi public

p6: add Security section — policy, OWASP compliance, pentest guide, secure configuration

swadhinbiswas committed 3 months ago
fe3c643
1 parent f35b086
commit fe3c643
4 files changed
+325 -0
Showing 4 changed files+325-0
docs_site/src/content/docs/security/owasp-compliance.mddocs_site/src/content/docs/security/penetration-testing.mddocs_site/src/content/docs/security/policy.mddocs_site/src/content/docs/security/secure-configuration.md
▼docs_site/src/content/docs/security/owasp-compliance.md
+79-0
@@ -0,0 +1,79 @@
1
+---
2
+title: OWASP Top 10 Compliance
3
+description: JustAPI's compliance status against OWASP Top 10 (2021) security categories.
4
+---
5
+
6
+## A01: Broken Access Control
7
+- ✅ Route-level access via middleware chain (JwtAuth, custom auth)
8
+- ✅ CORS middleware with configurable `allow_origin`
9
+- [ ] Per-route authorization middleware
10
+- [ ] Rate limiting per authenticated user
11
+
12
+## A02: Cryptographic Failures
13
+- ✅ TLS via rustls (TLS 1.2/1.3 only, no legacy protocols)
14
+- ✅ HSTS header with configurable `max-age`
15
+- ✅ JWT signing with HS256/RS256/ES256
16
+- ✅ Secrets management (env/file/inline, no logging)
17
+- [ ] Key rotation without restart (hot-reload)
18
+
19
+## A03: Injection
20
+- ✅ SQL injection prevention: parameterized queries via `sqlx`
21
+- ✅ JSON Schema validation rejects unexpected types
22
+- ✅ XSS prevention via CSP headers
23
+- ✅ Content-Type sniffing prevention: `X-Content-Type-Options: nosniff`
24
+- [ ] HTML sanitization for user-rendered content
25
+
26
+## A04: Insecure Design
27
+- ✅ Rate limiting: global and per-IP
28
+- ✅ Circuit breaker pattern
29
+- ✅ Timeout middleware (504 Gateway Timeout)
30
+- ✅ Graceful degradation via FallbackMiddleware
31
+- ✅ Bulkhead pattern for concurrent request limiting
32
+- ✅ Graceful shutdown (SIGTERM → drain → stop)
33
+- [ ] Request body depth limits
34
+
35
+## A05: Security Misconfiguration
36
+- ✅ CORS with configurable origins, methods, headers
37
+- ✅ Security headers (X-Content-Type-Options, X-Frame-Options, HSTS, CSP)
38
+- ✅ Non-root user in Docker image
39
+- ✅ HEALTHCHECK in Dockerfile
40
+- [ ] Automated security header check in CI
41
+
42
+## A06: Vulnerable and Outdated Components
43
+- ✅ `cargo-audit` in CI (vulnerability scanning)
44
+- ✅ `cargo-deny` in CI (license + advisory checks)
45
+- ✅ Dependabot for automated dependency updates
46
+- ✅ Supply chain: lockfile committed, `deny.toml` configured
47
+- [ ] Trivy scanning for Docker image vulnerabilities
48
+
49
+## A07: Identification and Authentication Failures
50
+- ✅ JWT authentication middleware
51
+- ✅ OAuth2/OIDC support via custom middleware
52
+- [ ] Multi-factor authentication support
53
+
54
+## A08: Software and Data Integrity Failures
55
+- ✅ Supply chain: lockfile, cargo-deny, Dependabot
56
+- [ ] CI/CD pipeline signing (sigstore/cosign)
57
+- [ ] Plugin signature verification
58
+
59
+## A09: Security Logging and Monitoring Failures
60
+- ✅ Structured logging (JSON or text format)
61
+- ✅ Audit logging middleware
62
+- ✅ Prometheus metrics with latency histograms
63
+- ✅ Health check endpoints (/health, /live, /ready)
64
+- ✅ Alerting: Slack, PagerDuty, Generic webhook
65
+- ✅ OpenTelemetry tracing integration
66
+
67
+## A10: Server-Side Request Forgery (SSRF)
68
+- [ ] URL validation middleware for outbound requests
69
+- [ ] Allow-list of outbound hosts
70
+
71
+## Legend
72
+- ✅ Implemented
73
+- [ ] Planned / not yet implemented
74
+
75
+## See Also
76
+
77
+- [Security Policy](/security/policy/) — Vulnerability reporting
78
+- [Penetration Testing](/security/penetration-testing/) — Pentest guidelines
79
+- [Secure Configuration](/security/secure-configuration/) — Hardening guide
0
80
▼docs_site/src/content/docs/security/penetration-testing.md
+99-0
@@ -0,0 +1,99 @@
1
+---
2
+title: Penetration Testing Guide
3
+description: Guidelines and test scenarios for security testing JustAPI applications.
4
+---
5
+
6
+## Attack Surface
7
+
8
+| Component | Description | Port |
9
+|---|---|---|
10
+| HTTP/HTTPS server | Main application server | 8080 (configurable) |
11
+| WebSocket endpoint | `/ws` upgrade path | Same as HTTP |
12
+| SSE endpoint | `/events` streaming | Same as HTTP |
13
+| Health endpoints | `/health`, `/live`, `/ready` | Same as HTTP |
14
+| Metrics endpoint | `/metrics` | Same as HTTP |
15
+| OpenAPI docs | `/docs`, `/redoc`, `/scalar` | Same as HTTP |
16
+
17
+## Test Scenarios
18
+
19
+### 1. Authentication & Authorization
20
+- JWT forgery: malformed, expired, algorithm-confusion, `none`-algorithm tokens
21
+- Missing auth: access protected routes without Authorization header
22
+- Token replay: capture and replay from different IP
23
+- CORS bypass: cross-origin requests not in allow list
24
+
25
+### 2. Input Validation
26
+- JSON injection: malformed, deeply nested, duplicate keys, large payloads
27
+- SQL injection: parameterized queries via `sqlx` (should be safe)
28
+- Path traversal: `../` sequences, URL-encoded variants
29
+- Parameter pollution: duplicate query parameters
30
+
31
+### 3. Rate Limiting & DoS
32
+- Global rate limit: flood from single IP (expect 429 + Retry-After)
33
+- Per-IP rate limit: exceed per-IP burst (expect 429)
34
+- Bulkhead saturation: concurrent connections (expect 503)
35
+- Slow loris: slow data send (expect 504 timeout)
36
+- Resource exhaustion: large allocations
37
+
38
+### 4. TLS & Network
39
+- Downgrade attack: TLS 1.1 or 1.0 (should fail — rustls only supports 1.2/1.3)
40
+- Weak cipher suites: NULL, EXPORT, RC4 ciphers (should fail)
41
+- Certificate validation: self-signed, expired, wrong-domain
42
+- Host header injection
43
+
44
+### 5. Information Disclosure
45
+- Stack traces: trigger unhandled errors (should return generic 500)
46
+- Debug endpoints: verify `/metrics` doesn't leak sensitive data
47
+- Server header: verify not present or generic
48
+- Timing attacks: measure response time differences
49
+
50
+## Fuzz Testing
51
+
52
+```bash
53
+# Install cargo-fuzz (nightly)
54
+rustup toolchain install nightly
55
+cargo install cargo-fuzz
56
+
57
+# Run fuzz targets (300 seconds each)
58
+cargo fuzz run fuzz_jwt -- -max_total_time=300
59
+cargo fuzz run fuzz_headers -- -max_total_time=300
60
+cargo fuzz run fuzz_body -- -max_total_time=300
61
+cargo fuzz run fuzz_router -- -max_total_time=300
62
+cargo fuzz run fuzz_query_params -- -max_total_time=300
63
+cargo fuzz run fuzz_file_paths -- -max_total_time=300
64
+```
65
+
66
+## Security Tools
67
+
68
+| Tool | Purpose |
69
+|---|---|
70
+| `cargo audit` | Vulnerability scanning |
71
+| `cargo deny` | License/advisory checks |
72
+| `curl` | Manual request testing |
73
+| `oha` | Load testing |
74
+| `nmap` | Port/service discovery |
75
+| `testssl.sh` | TLS configuration test |
76
+| `jwt_tool` | JWT attack toolkit |
77
+| `sqlmap` | SQL injection detection |
78
+
79
+## Reporting
80
+
81
+Use CVSS 3.1 for severity scoring:
82
+
83
+```
84
+Title: <brief description>
85
+Severity: CVSS 3.1 <score> (<Critical/High/Medium/Low>)
86
+Endpoint: <method> <path>
87
+Type: <OWASP category>
88
+
89
+## Description
90
+## Steps to Reproduce
91
+## Impact
92
+## Recommended Fix
93
+```
94
+
95
+## See Also
96
+
97
+- [Security Policy](/security/policy/) — Vulnerability reporting
98
+- [OWASP Compliance](/security/owasp-compliance/) — Compliance checklist
99
+- [Secure Configuration](/security/secure-configuration/) — Hardening guide
0
100
▼docs_site/src/content/docs/security/policy.md
+56-0
@@ -0,0 +1,56 @@
1
+---
2
+title: Security Policy
3
+description: Supported versions, vulnerability reporting, and disclosure process.
4
+---
5
+
6
+## Supported Versions
7
+
8
+| Version | Supported |
9
+|---|---|
10
+| >= 1.0 | ✅ Active |
11
+| < 1.0 | ⚠️ Dev-only (report anyway) |
12
+
13
+## Reporting a Vulnerability
14
+
15
+**DO NOT** file a public GitHub issue for security vulnerabilities.
16
+
17
+Send details to **[email protected]** with:
18
+
19
+1. **Subject**: `[JustAPI Security] <brief description>`
20
+2. **Affected version(s)**
21
+3. **Type of vulnerability** (e.g., XSS, RCE, SQL injection, information disclosure)
22
+4. **Steps to reproduce** (minimal proof of concept preferred)
23
+5. **Impact assessment**
24
+6. **Suggested fix** (optional)
25
+
26
+### Response Timeline
27
+
28
+- **24h**: Acknowledgment of receipt
29
+- **7 days**: Triage and severity assessment
30
+- **90 days**: Fix released (or extension negotiated)
31
+- **Disclosure**: Coordinated public disclosure after fix is available
32
+
33
+## Scope
34
+
35
+### In-Scope
36
+
37
+- JustAPI framework source code (all crates)
38
+- Official Docker images (`ghcr.io/justapi/*`)
39
+- Official Helm chart
40
+- Build pipeline and CI/CD configuration
41
+
42
+### Out-of-Scope
43
+
44
+- Third-party plugins
45
+- Applications built _with_ JustAPI (report to the app maintainer)
46
+- Infrastructure not owned by the JustAPI project
47
+
48
+## Bug Bounty
49
+
50
+This project does not currently offer a paid bug bounty program. Contributors will be credited in release notes and the security hall of fame (opt-out available).
51
+
52
+## See Also
53
+
54
+- [OWASP Compliance](/security/owasp-compliance/) — OWASP Top 10 checklist
55
+- [Penetration Testing](/security/penetration-testing/) — Pentest guidelines
56
+- [Secure Configuration](/security/secure-configuration/) — Hardening guide
0
57
▼docs_site/src/content/docs/security/secure-configuration.md
+91-0
@@ -0,0 +1,91 @@
1
+---
2
+title: Secure Configuration
3
+description: Hardening guide for running JustAPI securely in production.
4
+---
5
+
6
+## Security Headers
7
+
8
+Enable secure headers explicitly (not automatic):
9
+
10
+```python
11
+app.enable_secure_headers(with_hsts=True)
12
+```
13
+
14
+Headers added:
15
+- `Strict-Transport-Security: max-age=31536000` (with `includeSubDomains`)
16
+- `X-Content-Type-Options: nosniff`
17
+- `X-Frame-Options: DENY`
18
+- `Content-Security-Policy: default-src 'self'`
19
+- `X-XSS-Protection: 0`
20
+- `Referrer-Policy: no-referrer`
21
+
22
+## CORS Configuration
23
+
24
+CORS is deny-by-default. Configure explicitly:
25
+
26
+```python
27
+app.add_cors(
28
+ allow_origins=["https://app.example.com"], # Never use ["*"] in production
29
+ allow_methods=["GET", "POST", "PUT", "DELETE"],
30
+ allow_headers=["Authorization", "Content-Type"],
31
+ allow_credentials=True,
32
+)
33
+```
34
+
35
+## Rate Limiting
36
+
37
+```python
38
+# Global rate limit
39
+app.enable_rate_limiter(max_requests=1000, window_seconds=60)
40
+
41
+# Per-IP rate limit
42
+app.enable_ip_rate_limiter(max_requests=100, window_seconds=60)
43
+```
44
+
45
+## Request Body Size
46
+
47
+```python
48
+app.run("0.0.0.0:8000", max_body_size=1024 * 1024) # 1 MiB
49
+```
50
+
51
+## Secrets Management
52
+
53
+```python
54
+# Never hardcode secrets
55
+# Use environment variables:
56
+import os
57
+DATABASE_URL = os.environ["DATABASE_URL"]
58
+JWT_SECRET = os.environ["JWT_SECRET"]
59
+```
60
+
61
+## TLS Configuration
62
+
63
+Recommended: terminate TLS at the edge proxy. If using native TLS:
64
+
65
+```python
66
+# Server configured with rustls (TLS 1.2/1.3 only)
67
+app.run_tls(
68
+ "0.0.0.0:8443",
69
+ cert_path="/etc/certs/cert.pem",
70
+ key_path="/etc/certs/key.pem",
71
+)
72
+```
73
+
74
+## Security Checklist
75
+
76
+- [ ] Secure headers enabled
77
+- [ ] CORS restricted to specific origins
78
+- [ ] Rate limiting configured
79
+- [ ] Body size limits set
80
+- [ ] TLS termination configured (proxy or native)
81
+- [ ] Secrets in environment variables, not code
82
+- [ ] CI/CD: cargo audit, cargo deny passing
83
+- [ ] Logging: no PII in request bodies
84
+- [ ] Non-root user in Docker
85
+- [ ] Regular dependency updates via Dependabot
86
+
87
+## See Also
88
+
89
+- [Security Policy](/security/policy/) — Vulnerability reporting
90
+- [OWASP Compliance](/security/owasp-compliance/) — Compliance checklist
91
+- [Penetration Testing](/security/penetration-testing/) — Pentest guidelines
0
92