Application Security Best Practices 2025

name: Security Checks
on: [pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      # SAST - Static code analysis
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/ci

      # SCA - Dependency vulnerability scan
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      # Secret scanning
      - name: Gitleaks scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Container scanning
      - name: Trivy container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:latest'
          severity: 'CRITICAL,HIGH'
          exit-code: '1' # Fail pipeline on vulnerabilities

stages:
- stage: SecurityScan
  jobs:
  - job: SAST
    steps:
    - task: CredScan@3 # Microsoft Credential Scanner
      inputs:
        outputFormat: 'pre'

    - task: SonarCloudPrepare@1
      inputs:
        SonarCloud: 'SonarCloud-Connection'
        organization: 'my-org'
        projectKey: 'my-project'

    - task: DotNetCoreCLI@2
      inputs:
        command: 'build'

    - task: SonarCloudAnalyze@1

    - task: SonarCloudPublish@1
      inputs:
        pollingTimeoutSec: '300'

  - job: DependencyScan
    steps:
    - task: NuGetCommand@2
      inputs:
        command: 'restore'

    - task: WhiteSource@21 # Mend SCA
      inputs:
        cwd: '$(System.DefaultWorkingDirectory)'
        projectName: 'MyApp'

  - job: ContainerScan
    steps:
    - task: Docker@2
      inputs:
        command: 'build'
        Dockerfile: '**/Dockerfile'

    - task: AquaScanner@4
      inputs:
        image: 'myapp:latest'
        scanner: 'aqua'
        connection: 'AquaConnection'

# policy.rego - Kubernetes security policies
package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  not input.request.object.spec.securityContext.runAsNonRoot
  msg := "Containers must not run as root"
}

deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  not container.securityContext.readOnlyRootFilesystem
  msg := sprintf("Container %v must use read-only root filesystem", [container.name])
}

deny[msg] {
  input.request.kind.kind == "Service"
  input.request.object.spec.type == "LoadBalancer"
  not input.request.object.metadata.annotations["service.beta.kubernetes.io/azure-load-balancer-internal"]
  msg := "LoadBalancer services must be internal only"
}

# Test policies in CI/CD
opa test policy.rego policy_test.rego
opa exec --decision kubernetes/admission --bundle policy/ kubernetes-manifest.yaml

# .github/workflows/iac-security.yml
name: IaC Security Scan
on: [push]

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          output_format: cli
          soft_fail: false # Fail build on security issues

      - name: tfsec scan
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          working_directory: terraform/

      # Example Terraform security check results:
      # ❌ CRITICAL: S3 bucket encryption not enabled
      # ❌ HIGH: Security group allows 0.0.0.0/0 ingress
      # ❌ MEDIUM: IAM policy allows wildcard actions

// Node.js - JWT verification with proper validation
const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');

const client = jwksClient({
  jwksUri: 'https://auth.example.com/.well-known/jwks.json',
  cache: true,
  rateLimit: true
});

function getKey(header, callback) {
  client.getSigningKey(header.kid, (err, key) => {
    const signingKey = key.publicKey || key.rsaPublicKey;
    callback(null, signingKey);
  });
}

function authenticateToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }

  jwt.verify(token, getKey, {
    algorithms: ['RS256'],
    audience: 'api.example.com',
    issuer: 'https://auth.example.com',
    maxAge: '1h' // Token expiration
  }, (err, decoded) => {
    if (err) {
      return res.status(403).json({ error: 'Invalid token' });
    }
    req.user = decoded;
    next();
  });
}

// Scope-based authorization
function requireScope(scope) {
  return (req, res, next) => {
    if (!req.user.scope.includes(scope)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
}

app.get('/api/admin/users',
  authenticateToken,
  requireScope('admin:read'),
  (req, res) => {
    // Handler
  }
);

// Express rate limiting (sliding window)
const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');
const Redis = require('ioredis');

const redis = new Redis({
  host: process.env.REDIS_HOST,
  password: process.env.REDIS_PASSWORD
});

// Global rate limit
const globalLimiter = rateLimit({
  store: new RedisStore({
    client: redis,
    prefix: 'rl:global:'
  }),
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // 100 requests per window
  standardHeaders: true,
  legacyHeaders: false,
  handler: (req, res) => {
    res.status(429).json({
      error: 'Too many requests',
      retryAfter: req.rateLimit.resetTime
    });
  }
});

// Endpoint-specific limits
const authLimiter = rateLimit({
  store: new RedisStore({ client: redis, prefix: 'rl:auth:' }),
  windowMs: 15 * 60 * 1000,
  max: 5, // Stricter limit for auth endpoints
  skipSuccessfulRequests: true // Only count failed attempts
});

// User-specific rate limiting
const userLimiter = rateLimit({
  store: new RedisStore({ client: redis, prefix: 'rl:user:' }),
  windowMs: 60 * 1000,
  max: 60,
  keyGenerator: (req) => req.user.id // Per-user limit
});

app.use('/api/', globalLimiter);
app.post('/api/auth/login', authLimiter);
app.use('/api/user/*', authenticateToken, userLimiter);

// Zod schema validation
const { z } = require('zod');

const UserSchema = z.object({
  email: z.string().email().max(255),
  password: z.string()
    .min(12, 'Password must be at least 12 characters')
    .regex(/[A-Z]/, 'Must contain uppercase')
    .regex(/[a-z]/, 'Must contain lowercase')
    .regex(/[0-9]/, 'Must contain number')
    .regex(/[^A-Za-z0-9]/, 'Must contain special char'),
  age: z.number().int().min(18).max(120),
  role: z.enum(['user', 'admin', 'moderator'])
});

app.post('/api/users', async (req, res) => {
  try {
    const validatedData = UserSchema.parse(req.body);

    // Additional business logic validation
    const existingUser = await db.users.findOne({
      email: validatedData.email
    });
    if (existingUser) {
      return res.status(409).json({ error: 'Email already exists' });
    }

    // Sanitize HTML inputs
    const sanitizeHtml = require('sanitize-html');
    if (validatedData.bio) {
      validatedData.bio = sanitizeHtml(validatedData.bio, {
        allowedTags: ['b', 'i', 'em', 'strong'],
        allowedAttributes: {}
      });
    }

    const user = await createUser(validatedData);
    res.json({ id: user.id });

  } catch (error) {
    if (error instanceof z.ZodError) {
      return res.status(400).json({
        errors: error.errors
      });
    }
    throw error;
  }
});

# Kong API Gateway configuration
services:
  - name: user-service
    url: http://users:8080
    routes:
      - name: users-route
        paths:
          - /api/users
    plugins:
      # Rate limiting
      - name: rate-limiting
        config:
          minute: 60
          policy: redis

      # JWT authentication
      - name: jwt
        config:
          key_claim_name: kid
          secret_is_base64: false

      # Request validation
      - name: request-validator
        config:
          body_schema: |
            {
              "type": "object",
              "properties": {
                "email": {"type": "string", "format": "email"}
              },
              "required": ["email"]
            }

      # CORS
      - name: cors
        config:
          origins:
            - https://app.example.com
          credentials: true
          max_age: 3600

      # IP restriction
      - name: ip-restriction
        config:
          allow:
            - 10.0.0.0/8
            - 172.16.0.0/12

      # Bot detection
      - name: bot-detection
        config:
          allow:
            - Googlebot
          deny:
            - BadBot

const { ApolloServer } = require('apollo-server');
const depthLimit = require('graphql-depth-limit');
const { createComplexityLimitRule } = require('graphql-validation-complexity');

const server = new ApolloServer({
  typeDefs,
  resolvers,

  // Query depth limiting (prevent deeply nested queries)
  validationRules: [
    depthLimit(7), // Max 7 levels deep
    createComplexityLimitRule(1000, {
      scalarCost: 1,
      objectCost: 10,
      listFactor: 20
    })
  ],

  // Query cost analysis
  plugins: [{
    requestDidStart() {
      return {
        didResolveOperation({ request, operation }) {
          const complexity = calculateComplexity({
            query: request.query,
            variables: request.variables
          });

          if (complexity > 1000) {
            throw new Error('Query too complex');
          }
        }
      };
    }
  }],

  // Disable introspection in production
  introspection: process.env.NODE_ENV !== 'production',

  // Context authentication
  context: ({ req }) => {
    const token = req.headers.authorization || '';
    const user = verifyToken(token);
    return { user };
  }
});

// Field-level authorization
const resolvers = {
  User: {
    email: (parent, args, context) => {
      if (context.user.id !== parent.id && !context.user.isAdmin) {
        throw new Error('Unauthorized');
      }
      return parent.email;
    }
  }
};

# Infrastructure as Code - SOC2 compliant AWS setup
resource "aws_s3_bucket" "data" {
  bucket = "company-data"

  # CC6.6 - Encryption at rest
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "aws:kms"
        kms_master_key_id = aws_kms_key.data.arn
      }
    }
  }

  # CC6.1 - Access logging
  logging {
    target_bucket = aws_s3_bucket.logs.id
    target_prefix = "s3-access-logs/"
  }

  # Versioning for data integrity
  versioning {
    enabled = true
  }
}

# CC7.2 - Automated compliance monitoring
resource "aws_config_rule" "s3_encryption_check" {
  name = "s3-bucket-server-side-encryption-enabled"

  source {
    owner = "AWS"
    source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

# CC8.1 - Security monitoring
resource "aws_cloudwatch_metric_alarm" "unauthorized_api_calls" {
  alarm_name = "unauthorized-api-calls"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods = "1"
  metric_name = "UnauthorizedAPICalls"
  namespace = "CloudTrailMetrics"
  period = "300"
  statistic = "Sum"
  threshold = "5"
  alarm_actions = [aws_sns_topic.security_alerts.arn]
}

# Azure Policy - automated compliance enforcement
resource "azurerm_policy_assignment" "gdpr_compliance" {
  name = "gdpr-compliance"
  scope = azurerm_resource_group.main.id
  policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/GDPR"

  parameters = jsonencode({
    effect = { value = "Audit" }
  })
}

# AWS Security Hub - continuous compliance
resource "aws_securityhub_account" "main" {}

resource "aws_securityhub_standards_subscription" "cis" {
  standards_arn = "arn:aws:securityhub:region::standards/cis-aws-foundations-benchmark/v/1.4.0"
}

resource "aws_securityhub_standards_subscription" "pci" {
  standards_arn = "arn:aws:securityhub:region::standards/pci-dss/v/3.2.1"
}

# Compliance-as-Code - Terraform Sentinel policies
policy "encryption_at_rest" {
  enforcement_level = "hard-mandatory"
}

rule "s3_encryption_required" {
  condition = all s3_buckets as bucket {
    bucket.server_side_encryption_configuration is not null
  }
}