Cursor rule

1---
2description: Detect and prevent identification and authentication failures in JavaScript applications as defined in OWASP Top 10:2021-A07
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Identification and Authentication Failures (OWASP A07:2021)
6 
7<rule>
8name: javascript_identification_authentication_failures
9description: Detect and prevent identification and authentication failures in JavaScript applications as defined in OWASP Top 10:2021-A07
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Weak Password Validation
15      - pattern: "(?:password|passwd|pwd)\\s*\\.\\s*(?:length\\s*[<>]=?\\s*(?:[0-9]|10)\\b|match\\(\\s*['\"][^'\"]*['\"]\\s*\\))"
16        message: "Weak password validation detected. Implement strong password policies requiring minimum length, complexity, and avoiding common passwords."
17        
18      # Pattern 2: Missing MFA Implementation
19      - pattern: "(?:login|signin|authenticate|auth)\\s*\\([^)]*\\)\\s*\\{[^}]*?\\}"
20        negative_pattern: "(?:mfa|2fa|two-factor|multi-factor|otp|totp)"
21        message: "Authentication implementation without multi-factor authentication (MFA). Consider implementing MFA for enhanced security."
22        
23      # Pattern 3: Hardcoded Credentials
24      - pattern: "(?:const|let|var)\\s+(?:password|passwd|pwd|secret|key|token|apiKey)\\s*=\\s*['\"][^'\"]+['\"]"
25        message: "Hardcoded credentials detected. Store sensitive authentication data in secure configuration or environment variables."
26        
27      # Pattern 4: Insecure Session Management
28      - pattern: "(?:localStorage|sessionStorage)\\.setItem\\(['\"](?:token|jwt|session|auth|user)['\"]"
29        message: "Storing authentication tokens in localStorage or sessionStorage. Consider using HttpOnly cookies for sensitive authentication data."
30        
31      # Pattern 5: Missing CSRF Protection
32      - pattern: "(?:post|put|delete|patch)\\([^)]*?\\)"
33        negative_pattern: "(?:csrf|xsrf|token)"
34        location: "(?:src|components|pages|api)"
35        message: "Potential missing CSRF protection in API requests. Implement CSRF tokens for state-changing operations."
36        
37      # Pattern 6: Insecure JWT Handling
38      - pattern: "jwt\\.sign\\([^)]*?{[^}]*?}\\s*,\\s*[^,)]+\\s*(?:\\)|,\\s*{\\s*(?:expiresIn|algorithm)\\s*:\\s*[^}]*?}\\s*\\))"
39        negative_pattern: "(?:expiresIn|exp).*(?:algorithm|alg)"
40        message: "Insecure JWT configuration. Ensure JWTs have proper expiration and use secure algorithms (RS256 preferred over HS256)."
41        
42      # Pattern 7: Insecure Password Storage
43      - pattern: "(?:bcrypt|argon2|pbkdf2|scrypt)\\.[^(]*\\([^)]*?(?:rounds|iterations|cost|factor)\\s*[:<=>]\\s*(?:[0-9]|1[0-2])\\b"
44        message: "Weak password hashing parameters. Use sufficient work factors for password hashing algorithms."
45        
46      # Pattern 8: Missing Account Lockout
47      - pattern: "(?:login|signin|authenticate|auth)\\s*\\([^)]*\\)\\s*\\{[^}]*?\\}"
48        negative_pattern: "(?:lock|attempt|count|limit|throttle|rate)"
49        message: "Authentication implementation without account lockout or rate limiting. Implement account lockout after failed attempts."
50        
51      # Pattern 9: Insecure Password Recovery
52      - pattern: "(?:reset|forgot|recover)(?:Password|Pwd)\\s*\\([^)]*\\)\\s*\\{[^}]*?\\}"
53        negative_pattern: "(?:expire|timeout|token|verify)"
54        message: "Potentially insecure password recovery mechanism. Implement secure, time-limited recovery tokens."
55        
56      # Pattern 10: Missing Brute Force Protection
57      - pattern: "(?:login|signin|authenticate|auth)\\s*\\([^)]*\\)\\s*\\{[^}]*?\\}"
58        negative_pattern: "(?:captcha|recaptcha|hcaptcha|rate\\s*limit)"
59        message: "Authentication without CAPTCHA or rate limiting. Implement protection against brute force attacks."
60        
61      # Pattern 11: Insecure Remember Me Functionality
62      - pattern: "(?:rememberMe|keepLoggedIn|staySignedIn)"
63        negative_pattern: "(?:secure|httpOnly|sameSite)"
64        message: "Potentially insecure 'Remember Me' functionality. Implement with secure, HttpOnly cookies and proper expiration."
65        
66      # Pattern 12: Insecure Logout Implementation
67      - pattern: "(?:logout|signout)\\s*\\([^)]*\\)\\s*\\{[^}]*?\\}"
68        negative_pattern: "(?:invalidate|revoke|clear|remove).*(?:token|session|cookie)"
69        message: "Potentially incomplete logout implementation. Ensure proper invalidation of sessions and tokens on logout."
70        
71      # Pattern 13: Missing Session Timeout
72      - pattern: "(?:session|cookie|jwt)\\s*\\.\\s*(?:create|set|sign)"
73        negative_pattern: "(?:expire|timeout|maxAge)"
74        message: "Missing session timeout configuration. Implement proper session expiration for security."
75        
76      # Pattern 14: Insecure OAuth Implementation
77      - pattern: "(?:oauth|openid|oidc).*(?:callback|redirect)"
78        negative_pattern: "(?:state|nonce|pkce)"
79        message: "Potentially insecure OAuth implementation. Use state parameters, PKCE for authorization code flow, and validate redirect URIs."
80        
81      # Pattern 15: Missing Credential Validation
82      - pattern: "(?:email|username|user)\\s*=\\s*(?:req\\.body|req\\.query|req\\.params|formData\\.get)\\(['\"][^'\"]+['\"]\\)"
83        negative_pattern: "(?:validate|sanitize|check|trim)"
84        message: "Missing input validation for user credentials. Implement proper validation and sanitization."
85 
86  - type: suggest
87    message: |
88      **JavaScript Identification and Authentication Failures Best Practices:**
89      
90      1. **Strong Password Policies:**
91         - Implement minimum length (at least 12 characters)
92         - Require complexity (uppercase, lowercase, numbers, special characters)
93         - Check against common password lists
94         - Example:
95```javascript
96           // Using a library like zxcvbn for password strength estimation
97           import zxcvbn from 'zxcvbn';
98           
99           function validatePassword(password) {
100             if (password.length < 12) {
101               return { valid: false, message: 'Password must be at least 12 characters' };
102             }
103             
104             const strength = zxcvbn(password);
105             if (strength.score < 3) {
106               return { 
107                 valid: false, 
108                 message: 'Password is too weak. ' + strength.feedback.warning 
109               };
110             }
111             
112             return { valid: true };
113           }
114```
115      
116      2. **Multi-Factor Authentication (MFA):**
117         - Implement TOTP (Time-based One-Time Password)
118         - Support hardware security keys (WebAuthn/FIDO2)
119         - Example:
120```javascript
121           // Using speakeasy for TOTP implementation
122           import speakeasy from 'speakeasy';
123           
124           // Generate a secret for a user
125           const secret = speakeasy.generateSecret({ length: 20 });
126           
127           // Verify a token
128           function verifyToken(token, secret) {
129             return speakeasy.totp.verify({
130               secret: secret.base32,
131               encoding: 'base32',
132               token: token,
133               window: 1 // Allow 1 period before and after for clock drift
134             });
135           }
136```
137      
138      3. **Secure Session Management:**
139         - Use HttpOnly, Secure, and SameSite cookies
140         - Implement proper session expiration
141         - Example:
142```javascript
143           // Express.js example
144           app.use(session({
145             secret: process.env.SESSION_SECRET,
146             name: '__Host-session', // Prefix with __Host- for added security
147             cookie: {
148               httpOnly: true,
149               secure: true, // Requires HTTPS
150               sameSite: 'strict',
151               maxAge: 3600000, // 1 hour
152               path: '/'
153             },
154             resave: false,
155             saveUninitialized: false
156           }));
157```
158      
159      4. **CSRF Protection:**
160         - Implement CSRF tokens for all state-changing operations
161         - Example:
162```javascript
163           // Using csurf middleware with Express
164           import csrf from 'csurf';
165           
166           // Setup CSRF protection
167           const csrfProtection = csrf({ cookie: true });
168           
169           // Apply to routes
170           app.post('/api/user/profile', csrfProtection, (req, res) => {
171             // Handle the request
172           });
173           
174           // In your frontend (React example)
175           function ProfileForm() {
176             // Get CSRF token from cookie or meta tag
177             const csrfToken = document.querySelector('meta[name="csrf-token"]').content;
178             
179             return (
180               <form method="POST" action="/api/user/profile">
181                 <input type="hidden" name="_csrf" value={csrfToken} />
182                 {/* Form fields */}
183                 <button type="submit">Update Profile</button>
184               </form>
185             );
186           }
187```
188      
189      5. **Secure JWT Implementation:**
190         - Use strong algorithms (RS256 preferred over HS256)
191         - Include proper expiration (exp), issued at (iat), and audience (aud) claims
192         - Example:
193```javascript
194           import jwt from 'jsonwebtoken';
195           import fs from 'fs';
196           
197           // Using asymmetric keys (preferred for production)
198           const privateKey = fs.readFileSync('private.key');
199           
200           function generateToken(userId) {
201             return jwt.sign(
202               { 
203                 sub: userId,
204                 iat: Math.floor(Date.now() / 1000),
205                 exp: Math.floor(Date.now() / 1000) + (60 * 60), // 1 hour
206                 aud: 'your-app-name'
207               },
208               privateKey,
209               { algorithm: 'RS256' }
210             );
211           }
212```
213      
214      6. **Secure Password Storage:**
215         - Use bcrypt, Argon2, or PBKDF2 with sufficient work factor
216         - Example:
217```javascript
218           import bcrypt from 'bcrypt';
219           
220           async function hashPassword(password) {
221             // Cost factor of 12+ for production
222             const saltRounds = 12;
223             return await bcrypt.hash(password, saltRounds);
224           }
225           
226           async function verifyPassword(password, hash) {
227             return await bcrypt.compare(password, hash);
228           }
229```
230      
231      7. **Account Lockout and Rate Limiting:**
232         - Implement progressive delays or account lockout after failed attempts
233         - Example:
234```javascript
235           import rateLimit from 'express-rate-limit';
236           
237           // Apply rate limiting to login endpoint
238           const loginLimiter = rateLimit({
239             windowMs: 15 * 60 * 1000, // 15 minutes
240             max: 5, // 5 attempts per window
241             message: 'Too many login attempts, please try again after 15 minutes',
242             standardHeaders: true,
243             legacyHeaders: false,
244           });
245           
246           app.post('/api/login', loginLimiter, (req, res) => {
247             // Handle login
248           });
249```
250      
251      8. **Secure Password Recovery:**
252         - Use time-limited, single-use tokens
253         - Send to verified email addresses only
254         - Example:
255```javascript
256           import crypto from 'crypto';
257           
258           function generatePasswordResetToken() {
259             return {
260               token: crypto.randomBytes(32).toString('hex'),
261               expires: new Date(Date.now() + 3600000) // 1 hour
262             };
263           }
264           
265           // Store token in database with user ID and expiration
266           // Send token via email (never include in URL directly)
267           // Verify token is valid and not expired when used
268```
269      
270      9. **Brute Force Protection:**
271         - Implement CAPTCHA or reCAPTCHA
272         - Example:
273```javascript
274           // Using Google reCAPTCHA v3
275           async function verifyRecaptcha(token) {
276             const response = await fetch('https://www.google.com/recaptcha/api/siteverify', {
277               method: 'POST',
278               headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
279               body: `secret=${process.env.RECAPTCHA_SECRET_KEY}&response=${token}`
280             });
281             
282             const data = await response.json();
283             return data.success && data.score >= 0.5; // Adjust threshold as needed
284           }
285           
286           app.post('/api/login', async (req, res) => {
287             const { recaptchaToken } = req.body;
288             
289             if (!(await verifyRecaptcha(recaptchaToken))) {
290               return res.status(400).json({ error: 'CAPTCHA verification failed' });
291             }
292             
293             // Continue with login process
294           });
295```
296      
297      10. **Secure Logout Implementation:**
298          - Invalidate sessions on both client and server
299          - Example:
300```javascript
301            app.post('/api/logout', (req, res) => {
302              // Clear server-side session
303              req.session.destroy((err) => {
304                if (err) {
305                  return res.status(500).json({ error: 'Failed to logout' });
306                }
307                
308                // Clear client-side cookie
309                res.clearCookie('__Host-session', {
310                  httpOnly: true,
311                  secure: true,
312                  sameSite: 'strict',
313                  path: '/'
314                });
315                
316                res.status(200).json({ message: 'Logged out successfully' });
317              });
318            });
319```
320      
321      11. **Secure OAuth Implementation:**
322          - Use state parameter to prevent CSRF
323          - Implement PKCE for authorization code flow
324          - Validate redirect URIs against whitelist
325          - Example:
326```javascript
327            // Generate state and code verifier for PKCE
328            function generateOAuthState() {
329              return crypto.randomBytes(32).toString('hex');
330            }
331            
332            function generateCodeVerifier() {
333              return crypto.randomBytes(43).toString('base64url');
334            }
335            
336            function generateCodeChallenge(verifier) {
337              const hash = crypto.createHash('sha256').update(verifier).digest('base64url');
338              return hash;
339            }
340            
341            // Store state and code verifier in session
342            // Use code challenge in authorization request
343            // Verify state and use code verifier in token request
344```
345      
346      12. **Input Validation:**
347          - Validate and sanitize all user inputs
348          - Example:
349```javascript
350            import validator from 'validator';
351            
352            function validateCredentials(email, password) {
353              const errors = {};
354              
355              if (!validator.isEmail(email)) {
356                errors.email = 'Invalid email format';
357              }
358              
359              if (!password || password.length < 12) {
360                errors.password = 'Password must be at least 12 characters';
361              }
362              
363              return {
364                isValid: Object.keys(errors).length === 0,
365                errors
366              };
367            }
368```
369      
370      13. **Secure Headers:**
371          - Implement security headers for authentication-related pages
372          - Example:
373```javascript
374            // Using helmet with Express
375            import helmet from 'helmet';
376            
377            app.use(helmet({
378              contentSecurityPolicy: {
379                directives: {
380                  defaultSrc: ["'self'"],
381                  scriptSrc: ["'self'", 'https://www.google.com/recaptcha/', 'https://www.gstatic.com/recaptcha/'],
382                  frameSrc: ["'self'", 'https://www.google.com/recaptcha/'],
383                  styleSrc: ["'self'", "'unsafe-inline'"],
384                  connectSrc: ["'self'"]
385                }
386              },
387              referrerPolicy: { policy: 'same-origin' }
388            }));
389```
390      
391      14. **Credential Stuffing Protection:**
392          - Implement device fingerprinting and anomaly detection
393          - Example:
394```javascript
395            // Simple device fingerprinting
396            function getDeviceFingerprint(req) {
397              return {
398                ip: req.ip,
399                userAgent: req.headers['user-agent'],
400                acceptLanguage: req.headers['accept-language']
401              };
402            }
403            
404            // Check if login is from a new device
405            async function isNewDevice(userId, fingerprint) {
406              // Compare with stored fingerprints for this user
407              // Alert or require additional verification for new devices
408            }
409```
410      
411      15. **Secure Password Change:**
412          - Require current password verification
413          - Example:
414```javascript
415            async function changePassword(userId, currentPassword, newPassword) {
416              // Retrieve user from database
417              const user = await getUserById(userId);
418              
419              // Verify current password
420              const isValid = await bcrypt.compare(currentPassword, user.passwordHash);
421              if (!isValid) {
422                return { success: false, message: 'Current password is incorrect' };
423              }
424              
425              // Validate new password strength
426              const validation = validatePassword(newPassword);
427              if (!validation.valid) {
428                return { success: false, message: validation.message };
429              }
430              
431              // Hash and store new password
432              const newHash = await bcrypt.hash(newPassword, 12);
433              await updateUserPassword(userId, newHash);
434              
435              // Invalidate existing sessions (optional but recommended)
436              await invalidateUserSessions(userId);
437              
438              return { success: true };
439            }
440```
441 
442  - type: validate
443    conditions:
444      # Check 1: Strong Password Validation
445      - pattern: "(?:password|pwd).*(?:length\\s*>=\\s*(?:1[2-9]|[2-9][0-9]))"
446        message: "Implementing strong password length requirements (12+ characters)."
447      
448      # Check 2: Secure Password Storage
449      - pattern: "(?:bcrypt|argon2|pbkdf2|scrypt)\\.[^(]*\\([^)]*?(?:rounds|iterations|cost|factor)\\s*[:<=>]\\s*(?:1[2-9]|[2-9][0-9])"
450        message: "Using secure password hashing with appropriate work factor."
451      
452      # Check 3: CSRF Protection
453      - pattern: "(?:csrf|xsrf).*(?:token|middleware|protection)"
454        message: "Implementing CSRF protection for state-changing operations."
455      
456      # Check 4: Secure Cookie Configuration
457      - pattern: "(?:cookie|session).*(?:httpOnly|secure|sameSite)"
458        message: "Using secure cookie configuration for sessions."
459      
460      # Check 5: Rate Limiting
461      - pattern: "(?:rate|limit|throttle).*(?:login|signin|auth)"
462        message: "Implementing rate limiting for authentication endpoints."
463 
464metadata:
465  priority: high
466  version: 1.0
467  tags:
468    - security
469    - javascript
470    - nodejs
471    - browser
472    - authentication
473    - owasp
474    - language:javascript
475    - framework:express
476    - framework:react
477    - framework:vue
478    - framework:angular
479    - category:security
480    - subcategory:authentication
481    - standard:owasp-top10
482    - risk:a07-identification-authentication-failures
483  references:
484    - "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
485    - "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
486    - "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"
487    - "https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html"
488    - "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"
489    - "https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html"
490    - "https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/"
491    - "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Multifactor_Authentication_Cheat_Sheet.md"
492    - "https://www.nist.gov/itl/applied-cybersecurity/tig/back-basics-multi-factor-authentication"
493</rule> 
494