const {
SecurityHeadersManager,
CSRFProtection,
XSSPrevention,
RequestValidator,
DDoSProtection,
SecurityMonitor
} = require('edge-utils/security');
// Initialize security components
const headersManager = new SecurityHeadersManager({
contentSecurityPolicy: { enabled: true },
hsts: { maxAge: 31536000, includeSubDomains: true }
});
const csrf = new CSRFProtection({
secret: process.env.CSRF_SECRET
});
const xss = new XSSPrevention();
const validator = new RequestValidator();
validator.addSchema('login', {
type: 'object',
properties: {
username: { type: 'string', minLength: 3 },
password: { type: 'string', minLength: 8 }
},
required: ['username', 'password']
});
const ddos = new DDoSProtection({
spikeThreshold: 100,
blockDuration: 15 * 60 * 1000
});
const monitor = new SecurityMonitor({
storage: kvStorage
});
// Security middleware chain
const securityMiddleware = [
// DDoS protection (first)
ddos.middleware(),
// Security monitoring
async (request, context) => {
const startTime = Date.now();
try {
// Continue to next middleware
const response = await context.next();
// Log successful request
monitor.logEvent({
type: 'request',
severity: 'low',
source: getClientIP(request),
details: {
method: request.method,
path: request.url,
status: response.status,
duration: Date.now() - startTime
}
});
return response;
} catch (error) {
// Log failed request
monitor.logEvent({
type: 'error',
severity: 'medium',
source: getClientIP(request),
details: {
method: request.method,
path: request.url,
error: error.message
}
});
throw error;
}
},
// CSRF protection
csrf.middleware(),
// Input validation
async (request, context) => {
if (request.method === 'POST' && request.url.includes('/api/')) {
try {
const body = await request.json();
// Validate request
const validation = validator.validate(body, 'login');
if (!validation.valid) {
monitor.logEvent({
type: 'validation_error',
severity: 'medium',
source: getClientIP(request),
details: { errors: validation.errors }
});
return new Response(JSON.stringify({
error: 'Validation failed',
details: validation.errors
}), {
status: 400,
headers: { 'Content-Type': 'application/json' }
});
}
// Sanitize input
const sanitizedBody = {};
for (const [key, value] of Object.entries(body)) {
sanitizedBody[key] = typeof value === 'string' ? xss.sanitize(value) : value;
}
// Replace request body
request = new Request(request.url, {
...request,
body: JSON.stringify(sanitizedBody)
});
} catch (error) {
return new Response('Invalid JSON', { status: 400 });
}
}
return await context.next();
},
// Security headers (last)
async (request, context) => {
const response = await context.next();
// Add security headers
const securityHeaders = headersManager.generate({
request,
nonce: generateNonce()
});
for (const [key, value] of Object.entries(securityHeaders)) {
response.headers.set(key, value);
}
return response;
}
];
// Apply security middleware
const secureHandler = applyMiddleware(securityMiddleware, baseHandler);
