🛡️ Sentinel: [CRITICAL/HIGH] Fix hardcoded JWT secret and restrict CORS

.jules/sentinel.md

@@ -0,0 +1,6 @@
+# Sentinel's Journal - Secure Notes Web App
+
+## 2025-05-15 - [Critical] Hardcoded JWT Secret and Open CORS
+**Vulnerability:** The application had a hardcoded fallback for `JWT_SECRET` in `backend/src/middleware/auth.ts`, which would be used if the environment variable was missing. Additionally, CORS was configured to allow all origins in `backend/src/server.ts`.
+**Learning:** Hardcoded secrets in code are a major risk as they often end up in version control and can be easily discovered by attackers. Overly permissive CORS allows any website to make requests to the API, increasing the risk of CSRF and other cross-origin attacks.
+**Prevention:** Always require secrets to be provided via environment variables, especially in production. Fail fast if they are missing. Use restrictive CORS configurations that only allow trusted origins.

backend/src/middleware/auth.ts

@@ -9,7 +9,13 @@ export interface AuthRequest extends Request {
   userId?: string;
 }
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
+// 🛡️ Sentinel: Ensure JWT_SECRET is set in environment, especially in production
+// Treat undefined NODE_ENV as production for safety
+if (!process.env.JWT_SECRET && (!process.env.NODE_ENV || process.env.NODE_ENV === 'production')) {
+  throw new Error('JWT_SECRET environment variable is required in production');
+}
+
+const JWT_SECRET = process.env.JWT_SECRET || 'dev-secret-key-fallback';
 
 export function authenticateToken(
   req: AuthRequest,

backend/src/server.ts

@@ -12,7 +12,19 @@ const app = express();
 const PORT = process.env.PORT || 3000;
 
 // Middleware
-app.use(cors());
+// 🛡️ Sentinel: Ensure ALLOWED_ORIGINS is set in production
+if (!process.env.ALLOWED_ORIGINS && (!process.env.NODE_ENV || process.env.NODE_ENV === 'production')) {
+  throw new Error('ALLOWED_ORIGINS environment variable is required in production');
+}
+
+// 🛡️ Sentinel: Restrict CORS to specific origins for better security
+app.use(cors({
+  origin: process.env.ALLOWED_ORIGINS
+    ? process.env.ALLOWED_ORIGINS.split(',').map(s => s.trim())
+    : ['http://localhost:5173', 'http://localhost:3000'],
+  methods: ['GET', 'POST', 'PUT', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization']
+}));
 app.use(express.json());
 
 // Routes