security-patterns

1# Security Patterns
2 
3### When to Load
4 
5- **Trigger**: Auth flows, encryption, secrets management, CORS configuration, input validation, rate limiting
6- **Skip**: No security surface involved in the current task
7 
8## Security Implementation Workflow
9 
10Copy this checklist and track progress:
11 
12```
13Security Implementation Progress:
14- [ ] Step 1: Choose authentication strategy
15- [ ] Step 2: Implement authorization model
16- [ ] Step 3: Set up password hashing
17- [ ] Step 4: Configure secrets management
18- [ ] Step 5: Enable encryption (transit + rest)
19- [ ] Step 6: Configure CORS
20- [ ] Step 7: Add rate limiting
21- [ ] Step 8: Validate against anti-patterns checklist
22```
23 
24## Authentication Patterns
25 
26### JWT (JSON Web Tokens)
27 
28```typescript
29import jwt from "jsonwebtoken";
30 
31function generateTokens(user: User) {
32  const accessToken = jwt.sign(
33    { sub: user.id, role: user.role },
34    process.env.JWT_SECRET!,
35    { expiresIn: "15m", algorithm: "HS256" },
36  );
37  const refreshToken = jwt.sign(
38    { sub: user.id, tokenVersion: user.tokenVersion },
39    process.env.JWT_REFRESH_SECRET!,
40    { expiresIn: "7d" },
41  );
42  return { accessToken, refreshToken };
43}
44 
45// WRONG: localStorage (XSS vulnerable) | CORRECT: httpOnly cookie for refresh, memory for access
46res.cookie("refreshToken", refreshToken, {
47  httpOnly: true,
48  secure: true,
49  sameSite: "strict",
50  maxAge: 7 * 24 * 60 * 60 * 1000,
51  path: "/api/auth/refresh",
52});
53```
54 
55### JWT Verification Middleware
56 
57```typescript
58…