Security hardening: Fix XSS, add rate limiting, headers, and input validation

[Copilot]

Conducted security audit and addressed critical vulnerabilities. Application now has defense-in-depth protections against common web attacks.

Critical Fixes

• XSS vulnerability: Removed dangerouslySetInnerHTML from Login component that allowed arbitrary HTML injection via error messages
• Dependencies: Updated axios (DoS CVE) and express (body-parser/qs vulnerabilities)

Security Middleware

• Helmet: Added CSP, X-Frame-Options, X-Content-Type-Options, HSTS
• Rate limiting: 100 req/15min per IP on /api routes to mitigate DoS and brute-force
• Error handling: Production mode now returns generic errors, dev mode shows details

Input Validation

Created validation utility library with:

• validatePositiveInteger() - ID validation with proper error messages
• validateString() - length constraints and trimming
• validateEmail(), validateDate(), validateEnum()
• sanitizeSearchQuery() - escapes SQL wildcards for LIKE clauses with proper ESCAPE handling

Example usage:

router.get('/:id', async (req, res, next) => {
  const id = validatePositiveInteger(req.params.id, 'Order ID');
  const order = await repo.findById(id);
  // ...
});

Applied to order routes as pattern for other endpoints.

Verification

• CodeQL: 0 alerts
• All tests passing (18/18)
• Security headers verified in HTTP responses

Documentation

See docs/SECURITY_REVIEW.md for complete audit findings and production recommendations (auth, HTTPS, extended validation coverage).

Notes

Existing code already follows good practices: parameterized queries (no SQL injection), proper CORS configuration, repository pattern. Remaining dev dependency vulnerabilities (eslint, tsx, esbuild) are low-risk and non-production.

Original prompt

review security for the project

Created from VS Code.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.