Information Disclosure

// Node.js/Express - Secure information handling

// SECURE: Force production mode
if (process.env.NODE_ENV !== 'production') {
  throw new Error('NODE_ENV must be production');
}

// SECURE: Generic error handler that doesn't leak details
app.use((err, req, res, next) => {
  // Log full error details server-side only
  logger.error('Application error', {
    error: err.message,
    stack: err.stack,
    requestId: req.id,
    path: req.path,
    method: req.method,
    // Don't log sensitive data like passwords or tokens
    userId: req.user?.id
  });
  
  // Send generic error to client - no stack trace or details
  res.status(500).json({
    error: 'Internal server error',
    requestId: req.id  // Only for support tracking
  });
});

// SECURE: Redact sensitive fields from logs
const REDACTED_FIELDS = new Set([
  'password',
  'authorization',
  'cookie',
  'token',
  'secret',
  'apiKey',
  'creditCard'
]);

function redactSensitiveData(obj) {
  if (!obj || typeof obj !== 'object') return obj;
  
  const redacted = Array.isArray(obj) ? [] : {};
  
  for (const [key, value] of Object.entries(obj)) {
    const lowerKey = key.toLowerCase();
    const isSensitive = REDACTED_FIELDS.has(lowerKey) || 
                       lowerKey.includes('password') ||
                       lowerKey.includes('secret') ||
                       lowerKey.includes('token');
    
    if (isSensitive) {
      redacted[key] = '[REDACTED]';
    } else if (typeof value === 'object') {
      redacted[key] = redactSensitiveData(value);
    } else {
      redacted[key] = value;
    }
  }
  
  return redacted;
}

// SECURE: Login with safe logging
app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  
  // Safe logging - no password!
  logger.info('Login attempt', { 
    email,
    ip: req.ip,
    userAgent: req.get('User-Agent')
  });
  
  const user = await User.findOne({ email });
  const valid = await bcrypt.compare(password, user.passwordHash);
  
  if (valid) {
    const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET);
    
    // Don't log the actual token!
    logger.info('Login successful', { userId: user.id });
    
    res.json({ token });
  } else {
    logger.warn('Login failed', { email, ip: req.ip });
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

// SECURE: Health endpoint with minimal info
app.get('/health', (req, res) => {
  // Only return service status, no secrets or architecture
  res.json({
    status: 'healthy',
    timestamp: new Date().toISOString()
    // No database URLs, no internal hostnames, no secrets!
  });
});

// SECURE: Detailed metrics only for authenticated internal requests
app.get('/actuator/metrics', requireInternalAuth, (req, res) => {
  // Validate request comes from internal network
  const ip = req.ip;
  if (!isInternalIP(ip)) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  // Require authentication even for internal requests
  if (!req.user || !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  // Return metrics but still redact secrets
  res.json({
    database: {
      connected: true,
      // Don't include URL or credentials
    },
    redis: {
      connected: true
      // Don't include host or password
    }
  });
});

function isInternalIP(ip) {
  return ip === '127.0.0.1' || 
         ip.startsWith('10.') || 
         ip.startsWith('192.168.');
}

// SECURE: Prevent .git exposure with explicit blocking
app.use((req, res, next) => {
  // Block access to version control and backup files
  const blockedPatterns = [
    /\.git/,
    /\.svn/,
    /\.env/,
    /\.bak$/,
    /\.backup$/,
    /\.old$/,
    /\.map$/  // source maps
  ];
  
  if (blockedPatterns.some(pattern => pattern.test(req.path))) {
    return res.status(404).send('Not found');
  }
  
  next();
});

// SECURE: Static files with restrictions
const serveStatic = express.static('public', {
  dotfiles: 'deny',  // Block .git, .env, etc.
  index: false,      // Don't list directories
  setHeaders: (res, path) => {
    // Prevent source map access in production
    if (path.endsWith('.map')) {
      res.status(404).end();
    }
  }
});
app.use(serveStatic);

// SECURE: Generic 404 handler
app.use((req, res) => {
  // Don't reveal routing information
  res.status(404).json({ 
    error: 'Not found'
    // No server version, no available routes, no stack info
  });
});

// SECURE: Request logging middleware with redaction
app.use((req, res, next) => {
  const start = Date.now();
  
  res.on('finish', () => {
    const duration = Date.now() - start;
    
    // Log with redacted sensitive data
    logger.info('Request', {
      method: req.method,
      path: req.path,
      status: res.statusCode,
      duration,
      ip: req.ip,
      // Redact sensitive headers
      headers: redactSensitiveData(req.headers),
      // Don't log body - may contain passwords
    });
  });
  
  next();
});

// SECURE: Dockerfile best practices
/*
FROM node:18-alpine

WORKDIR /app

# .dockerignore includes:
# .git
# .env
# *.bak
# *.log
# node_modules

COPY package*.json ./
RUN npm ci --only=production

COPY dist/ ./dist/
# Don't copy source maps to production image
RUN find dist -name "*.map" -delete

# Don't run as root
USER node

CMD ["node", "dist/server.js"]
*/