Improve Server-Side Security

- Sanitize API requests
- Add Error handling middleware

Signed-off-by: Snehil Shah <[email protected]>

Author: Snehil-Shah

Backend/index.js

@@ -4,6 +4,7 @@ require("dotenv").config();
 const cors = require("cors");
 const routes_auth = require("./routes/auth");
 const routes_general = require("./routes/route");
+const { handleBadRequests } = require("./middlewares");
 const session = require("express-session");
 const bodyParser = require("body-parser");
 const { connectDB } = require("./db");
@@ -36,6 +37,8 @@ app.get("/", (_req, res) => {
 app.use("/", routes_general);
 app.use("/auth", routes_auth);
 
+app.use(handleBadRequests);
+
 // Start the server
 app.listen(process.env.PORT || 8000, () => {
   console.log(`connected to port ${process.env.PORT || 8000}`);

Backend/middlewares.js

@@ -1,11 +1,11 @@
-const jwt_decode = require('jwt-decode');
+const jwt_decode = require("jwt-decode");
 
 const ADMIN_ROLES = {
-  PRESIDENT: '[email protected]',
-  GENSEC_SCITECH: '[email protected]',
-  GENSEC_ACADEMIC: '[email protected]',
-  GENSEC_CULTURAL: '[email protected]',
-  GENSEC_SPORTS: '[email protected]',
+  PRESIDENT: "[email protected]",
+  GENSEC_SCITECH: "[email protected]",
+  GENSEC_ACADEMIC: "[email protected]",
+  GENSEC_CULTURAL: "[email protected]",
+  GENSEC_SPORTS: "[email protected]",
 };
 
 const ADMIN_CREDENTIALS = {
@@ -37,29 +37,33 @@ const authenticateAdmin = (req, res, next, expectedRole) => {
     const decoded = jwt_decode(jwtToken);
 
     if (!jwtToken || !isAdmin(decoded, expectedRole)) {
-      return res.status(401).json({ success: false, message: 'Unauthorized Admin' });
+      return res
+        .status(401)
+        .json({ success: false, message: "Unauthorized Admin" });
     }
 
     req.DB_credentials = ADMIN_CREDENTIALS[expectedRole];
     req.decoded = decoded;
     next();
   } catch (error) {
     console.error(error);
-    return res.status(500).json({ success: false, message: 'Internal Server Error' });
+    return res
+      .status(500)
+      .json({ success: false, message: "Internal Server Error" });
   }
 };
 
 const isAdmin = (decoded, expectedRole) => {
   return (
     decoded.email === ADMIN_ROLES[expectedRole] &&
-    decoded.iss === 'https://accounts.google.com' &&
+    decoded.iss === "https://accounts.google.com" &&
     decoded.exp > Date.now() / 1000 &&
     decoded.aud === process.env.GOOGLE_CLIENT_ID
   );
 };
 
 exports.restrictToPresident = (req, res, next) => {
-  authenticateAdmin(req, res, next, 'PRESIDENT');
+  authenticateAdmin(req, res, next, "PRESIDENT");
 };
 
 exports.restrictToAdmin = (req, res, next) => {
@@ -71,22 +75,33 @@ const getAdminRole = (req) => {
   const userEmail = decoded.email;
 
   if (userEmail === ADMIN_ROLES.GENSEC_SCITECH) {
-    return 'GENSEC_SCITECH';
+    return "GENSEC_SCITECH";
   } else if (userEmail === ADMIN_ROLES.GENSEC_ACADEMIC) {
-    return 'GENSEC_ACADEMIC';
+    return "GENSEC_ACADEMIC";
   } else if (userEmail === ADMIN_ROLES.GENSEC_CULTURAL) {
-    return 'GENSEC_CULTURAL';
+    return "GENSEC_CULTURAL";
   } else if (userEmail === ADMIN_ROLES.GENSEC_SPORTS) {
-    return 'GENSEC_SPORTS';
+    return "GENSEC_SPORTS";
   }
 
-  return ''; // Default case or handle as needed
+  return ""; // Default case or handle as needed
 };
 
 exports.isAuthenticated = (req, res, next) => {
   if (req.isAuthenticated()) {
     return next();
   } else {
-    return res.status(401).json({ message: 'Unauthorized' });
+    return res.status(401).json({ message: "Unauthorized" });
   }
 };
+
+exports.handleBadRequests = function (err, req, res) {
+  console.error(err.stack);
+  res.status(500).send("Something broke!");
+};
+
+exports.exceptionHandler = function (f) {
+  return function (req, res, next) {
+    Promise.resolve(f(req, res, next)).catch(next);
+  };
+};

Backend/package-lock.json

@@ -35,6 +35,7 @@
     "eslint-plugin-react": "^7.33.2",
     "express": "^4.18.2",
     "express-session": "^1.17.3",
+    "express-validator": "^7.0.1",
     "jsonwebtoken": "^9.0.2",
     "jwt-decode": "^3.1.2",
     "mongodb": "^6.1.0",