Zweck: Detail-Security-Checks zur Validierung der Accenture CDP Web Application Standards auf Code-/Architektur-Ebene.
Checkliste (4 Checks)
Phase: Build
Configuration
Verify that the Node.js is being run as a non-root user. ✅Container-User nextjs (uid=1001), non-root (Dockerfile.prod:87).
Ensure use of 'ratelimiter flexible' package to prevent Brute force attacks. ✅Äquivalent: eigenes Rate-Limit-Middleware (packages/api/src/middleware/rate-limit.ts) — 100/15min API, 5/15min Auth.
Ensure use of 'Helmet' module to set security-related HTTP response headers. ✅Äquivalent: Next.js Security-Headers via next.config.ts (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).
Use csurf module for protecting against CSRF attacks ✅Äquivalent: Auth.js CSRF-Token (authjs.csrf-token Cookie, siehe auth.config.ts:35) + SameSite=Strict auf allen Cookies.
## Quelle
- **xlsx:** `samples/CDP/checklists/nodejs.xlsx`
- **Parent-Control:** #30
- **Epic:** #1
- **Zweck:** Detail-Security-Checks zur Validierung der Accenture CDP Web Application Standards auf Code-/Architektur-Ebene.
## Checkliste (4 Checks)
### Phase: Build
#### Configuration
- [x] Verify that the Node.js is being run as a non-root user.
✅ *Container-User `nextjs` (uid=1001), non-root (`Dockerfile.prod:87`).*
- [x] Ensure use of 'ratelimiter flexible' package to prevent Brute force attacks.
✅ *Äquivalent: eigenes Rate-Limit-Middleware (`packages/api/src/middleware/rate-limit.ts`) — 100/15min API, 5/15min Auth.*
- [x] Ensure use of 'Helmet' module to set security-related HTTP response headers.
✅ *Äquivalent: Next.js Security-Headers via `next.config.ts` (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).*
- [x] Use csurf module for protecting against CSRF attacks
✅ *Äquivalent: Auth.js CSRF-Token (`authjs.csrf-token` Cookie, siehe `auth.config.ts:35`) + SameSite=Strict auf allen Cookies.*
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Quelle
samples/CDP/checklists/nodejs.xlsxCheckliste (4 Checks)
Phase: Build
Configuration
✅ Container-User
nextjs(uid=1001), non-root (Dockerfile.prod:87).✅ Äquivalent: eigenes Rate-Limit-Middleware (
packages/api/src/middleware/rate-limit.ts) — 100/15min API, 5/15min Auth.✅ Äquivalent: Next.js Security-Headers via
next.config.ts(HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).✅ Äquivalent: Auth.js CSRF-Token (
authjs.csrf-tokenCookie, sieheauth.config.ts:35) + SameSite=Strict auf allen Cookies.Review-Ergebnis
Detail-Analyse aller 4 Checks aus
samples/CDP/checklists/nodejs.xlsxgegen CapaKraken-Code unddocs/acn-security-compliance-status.md.Empfehlung:
Alle Checks abgedeckt. Ticket kann nach Owner-Review geschlossen werden.
Abschluss
Alle 4 Checks aus
samples/CDP/checklists/nodejs.xlsxsind erfüllt:rate-limiter-flexible) ✅next.config.tsstattHelmet) ✅SameSite=Strictstattcsurf) ✅Ticket wird geschlossen.