security-infra

Security Infrastructure Skill

Infrastructure security, headers, encryption, and compliance patterns.

Quick Reference

Security Headers

| Header | Purpose | Value | |--------|---------|-------| | Content-Security-Policy | XSS prevention | Restrict sources | | X-Frame-Options | Clickjacking | DENY | | Strict-Transport-Security | Force HTTPS | max-age=31536000 | | X-Content-Type-Options | MIME sniffing | nosniff | | Referrer-Policy | Leak prevention | strict-origin |

Helmet.js Configuration

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      objectSrc: ["'none'"],
      frameAncestors: ["'none'"],
    },
  },
  hsts: { maxAge: 31536000, includeSubDomains: true },
}));

Encryption (AES-256-GCM)

import crypto from 'crypto';

function encrypt(plaintext: string, key: Buffer): EncryptedData {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);

  let ciphertext = cipher.update(plaintext, 'utf8', 'base64');
  ciphertext += cipher.final('base64');

  return {
    ciphertext,
    iv: iv.toString('base64'),
    authTag: cipher.getAuthTag().toString('base64'),
  };
}

function decrypt(data: EncryptedData, key: Buffer): string {
  const decipher = crypto.createDecipheriv(
    'aes-256-gcm',
    key,
    Buffer.from(data.iv, 'base64')
  );
  decipher.setAuthTag(Buffer.from(data.authTag, 'base64'));

  let plaintext = decipher.update(data.ciphertext, 'base64', 'utf8');
  plaintext += decipher.final('utf8');

  return plaintext;
}

Secrets Management

// Environment variables (basic)
const apiKey = process.env.API_KEY;

// AWS Secrets Manager
import { SecretsManager } from '@aws-sdk/client-secrets-manager';
const client = new SecretsManager({ region: 'us-east-1' });
const secret = await client.getSecretValue({ SecretId: 'my-secret' });

// HashiCorp Vault
import Vault from 'node-vault';
const vault = Vault({ endpoint: process.env.VAULT_ADDR });
const { data } = await vault.read('secret/data/myapp');

CORS Configuration

import cors from 'cors';

app.use(cors({
  origin: ['https://app.example.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400,
}));

Compliance Checklist

GDPR Requirements

• [ ] Data minimization - collect only necessary data
• [ ] Consent management - explicit opt-in
• [ ] Right to erasure - delete user data on request
• [ ] Data portability - export user data
• [ ] Breach notification - 72-hour window

PCI-DSS Requirements

• [ ] Encrypt cardholder data at rest
• [ ] Use TLS 1.2+ for transmission
• [ ] Implement strong access control
• [ ] Regular security testing
• [ ] Maintain security policy

F5 Quality Gates

| Gate | Requirement | |------|-------------| | G4 | Security audit completed | | G5 | Production hardening verified | | G5 | Compliance checklist passed |