From a86629e24e282bf46391cea25ae3788982880b8d Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 15:16:17 +0000
Subject: [PATCH] Harden Express runtime and add Pages security headers

- Set trust proxy (TRUST_PROXY env, defaults to 1 in production) so
  express-rate-limit keys on the real client IP behind a proxy
- Add helmet with a CSP matching the Vite/Tailwind bundle
- Default NODE_ENV to production so an unset env never leaks stacks or
  skips SPA serving
- Map body-parser errors to 400/413/415 instead of generic 500
- Run CORS before rate limiting so preflights are not counted
- Drop unused urlencoded parser, duplicate unhandledRejection handler,
  and dead health-check skip
- Add Cloudflare Pages _headers (CSP, HSTS, nosniff, frame deny, etc.)

Co-Authored-By: Jason Maycock <jason@southbaycreations.com>
---
 .env.example                          |  4 ++
 package-lock.json                     | 13 ++++++
 server/.gitignore                     |  2 +
 server/client/public/_headers         | 15 +++++++
 server/package.json                   |  1 +
 server/src/config/index.ts            | 17 +++++++-
 server/src/index.ts                   | 57 ++++++++++++++++-----------
 server/src/middleware/errorHandler.ts | 27 ++++++++++++-
 server/src/middleware/rateLimiting.ts |  4 --
 9 files changed, 110 insertions(+), 30 deletions(-)
 create mode 100644 server/client/public/_headers

diff --git a/.env.example b/.env.example
index 18ee550..ac7ac13 100644
--- a/.env.example
+++ b/.env.example
@@ -8,6 +8,10 @@ NODE_ENV=development
 # Security
 CORS_ORIGIN=http://localhost:5173
 
+# Express `trust proxy` value: hop count (1), true/false, or address list ("loopback, 10.0.0.0/8").
+# Defaults to 1 in production (one TLS-terminating proxy in front) and false otherwise.
+# TRUST_PROXY=1
+
 # API Rate Limiting (Optional - defaults are secure)
 # General API rate limiting (15 minutes window)
 GENERAL_RATE_LIMIT_WINDOW_MS=900000
diff --git a/package-lock.json b/package-lock.json
index 5a99dc4..0184bcf 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3905,6 +3905,18 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/helmet": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.3.0.tgz",
+      "integrity": "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/EvanHahn"
+      }
+    },
     "node_modules/hookified": {
       "version": "1.15.1",
       "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
@@ -6610,6 +6622,7 @@
         "express": "^5.2.1",
         "express-rate-limit": "^8.7.0",
         "express-slow-down": "^3.1.1",
+        "helmet": "^8.3.0",
         "openai": "^7.17.0",
         "zod": "^4.6.5"
       },
diff --git a/server/.gitignore b/server/.gitignore
index c7ab0ea..4e3ff58 100644
--- a/server/.gitignore
+++ b/server/.gitignore
@@ -87,6 +87,8 @@ dist
 # Gatsby files
 .cache/
 public
+# Vite static assets (copied verbatim into client/dist)
+!client/public
 
 # vuepress build output
 .vuepress/dist
diff --git a/server/client/public/_headers b/server/client/public/_headers
new file mode 100644
index 0000000..6805594
--- /dev/null
+++ b/server/client/public/_headers
@@ -0,0 +1,15 @@
+# Cloudflare Pages response headers (applied to the static site and /api/* functions).
+# CSP: the SPA injects a <style> element for print rules, so styles allow 'unsafe-inline';
+# scripts are bundled by Vite and need only 'self'.
+/*
+  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
+  Strict-Transport-Security: max-age=31536000; includeSubDomains
+  X-Content-Type-Options: nosniff
+  X-Frame-Options: DENY
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+  Cross-Origin-Opener-Policy: same-origin
+  Cross-Origin-Resource-Policy: same-origin
+
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
diff --git a/server/package.json b/server/package.json
index b795806..7baaccb 100644
--- a/server/package.json
+++ b/server/package.json
@@ -26,6 +26,7 @@
     "express": "^5.2.1",
     "express-rate-limit": "^8.7.0",
     "express-slow-down": "^3.1.1",
+    "helmet": "^8.3.0",
     "openai": "^7.17.0",
     "zod": "^4.6.5"
   },
diff --git a/server/src/config/index.ts b/server/src/config/index.ts
index 9600d27..2828d34 100644
--- a/server/src/config/index.ts
+++ b/server/src/config/index.ts
@@ -24,9 +24,24 @@ if (missingVars.length > 0) {
 }
 
 export const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 3001;
-export const NODE_ENV = process.env.NODE_ENV || 'development';
+export const NODE_ENV = process.env.NODE_ENV || 'production';
+export const IS_PRODUCTION = NODE_ENV === 'production';
 export const CORS_ORIGIN = process.env.CORS_ORIGIN || 'http://localhost:5173';
 
+// Express `trust proxy` setting. Accepts the same values Express does:
+// a hop count ("1"), "true"/"false", or a comma-separated list of
+// addresses/CIDRs/presets ("loopback, 10.0.0.0/8"). Defaults to one hop in
+// production (TLS-terminating proxy in front) and none in development.
+const parseTrustProxy = (value: string | undefined): boolean | number | string => {
+  if (value === undefined || value === '') return IS_PRODUCTION ? 1 : false;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === 'true') return true;
+  if (normalized === 'false') return false;
+  if (/^\d+$/.test(normalized)) return parseInt(normalized, 10);
+  return value.trim();
+};
+export const TRUST_PROXY = parseTrustProxy(process.env.TRUST_PROXY);
+
 // Initialize OpenAI with explicit configuration
 export const openai = new OpenAI({
   apiKey: process.env.OPENAI_API_KEY,
diff --git a/server/src/index.ts b/server/src/index.ts
index 7b90a15..3c17b26 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -4,9 +4,10 @@ import { fileURLToPath } from 'url';
 import cors from 'cors';
 import dotenv from 'dotenv';
 import express, { Request, Response } from 'express';
+import helmet from 'helmet';
 
 // Import configuration and routes
-import { PORT, CORS_ORIGIN, NODE_ENV } from './config/index.js';
+import { PORT, CORS_ORIGIN, NODE_ENV, IS_PRODUCTION, TRUST_PROXY } from './config/index.js';
 import { errorHandler } from './middleware/errorHandler.js';
 import { generalRateLimit, requestSizeLimit, usageMonitor } from './middleware/rateLimiting.js';
 import worksheetRoutes from './routes/worksheet.js';
@@ -46,7 +47,8 @@ process.on('unhandledRejection', (reason: unknown) => {
 
 // Define app first
 const app = express();
-const isProduction = NODE_ENV === 'production';
+const isProduction = IS_PRODUCTION;
+app.set('trust proxy', TRUST_PROXY);
 
 // Declare server variable with proper type
 type ServerType = ReturnType<typeof app.listen>;
@@ -66,7 +68,36 @@ process.on('SIGTERM', () => {
 
 // App and server configuration moved above server declaration
 
-// Security middleware (applied first)
+// Security headers. The SPA injects a <style> element for print rules and
+// Tailwind emits no inline scripts, so only styles need 'unsafe-inline'.
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      useDefaults: true,
+      directives: {
+        'script-src': ["'self'"],
+        'style-src': ["'self'", "'unsafe-inline'"],
+        'img-src': ["'self'", 'data:'],
+        'connect-src': ["'self'"],
+        'frame-ancestors': ["'none'"],
+        'form-action': ["'self'"],
+        'upgrade-insecure-requests': isProduction ? [] : null,
+      },
+    },
+    crossOriginEmbedderPolicy: false,
+  })
+);
+
+// CORS configuration (before rate limiting so preflights are not counted)
+const corsOptions = {
+  origin: CORS_ORIGIN,
+  credentials: true,
+  optionsSuccessStatus: 200, // Some legacy browsers choke on 204
+};
+
+app.use(cors(corsOptions));
+
+// Security middleware
 app.use(requestSizeLimit);
 app.use(usageMonitor);
 app.use(generalRateLimit);
@@ -79,16 +110,6 @@ app.use((req: Request, _res: Response, next) => {
 
 // Middleware
 app.use(express.json({ limit: '1kb' })); // Enforce JSON size limit
-app.use(express.urlencoded({ extended: true, limit: '1kb' })); // Enforce URL encoded size limit
-
-// CORS configuration
-const corsOptions = {
-  origin: CORS_ORIGIN,
-  credentials: true,
-  optionsSuccessStatus: 200, // Some legacy browsers choke on 204
-};
-
-app.use(cors(corsOptions));
 
 // Simple health check endpoint
 app.get('/api/health', (_req: Request, res: Response) => {
@@ -201,13 +222,3 @@ server = app.listen(PORT, () => {
     console.log(`🔗 Health Check: http://localhost:${PORT}/api/health`);
   }
 });
-
-// Handle unhandled promise rejections
-process.on('unhandledRejection', (err: Error) => {
-  console.error('Unhandled Rejection:', err);
-  if (server) {
-    server.close(() => process.exit(1));
-  } else {
-    process.exit(1);
-  }
-});
diff --git a/server/src/middleware/errorHandler.ts b/server/src/middleware/errorHandler.ts
index 103b920..23cd4dd 100644
--- a/server/src/middleware/errorHandler.ts
+++ b/server/src/middleware/errorHandler.ts
@@ -1,7 +1,20 @@
 import { Request, Response, NextFunction, ErrorRequestHandler } from 'express';
 
+import { IS_PRODUCTION } from '../config/index.js';
 import { AppError, AppErrorInterface } from '../utils/AppError.js';
 
+// Client-side body errors raised by express.json (body-parser `type` codes).
+const BODY_PARSER_ERRORS: Record<string, { statusCode: number; message: string }> = {
+  'entity.parse.failed': { statusCode: 400, message: 'Request body must be valid JSON' },
+  'entity.too.large': { statusCode: 413, message: 'Request payload must be less than 1KB' },
+  'encoding.unsupported': { statusCode: 415, message: 'Unsupported content encoding' },
+  'charset.unsupported': { statusCode: 415, message: 'Unsupported charset' },
+  'entity.verify.failed': { statusCode: 403, message: 'Request body failed verification' },
+  'request.aborted': { statusCode: 400, message: 'Request aborted' },
+  'request.size.invalid': { statusCode: 400, message: 'Request size did not match Content-Length' },
+  'parameters.too.many': { statusCode: 413, message: 'Too many parameters' },
+};
+
 // Error handling middleware with proper type annotations
 export const errorHandler: ErrorRequestHandler = (
   err: any,
@@ -22,7 +35,7 @@ export const errorHandler: ErrorRequestHandler = (
   };
 
   // Log error in development
-  if (process.env.NODE_ENV === 'development') {
+  if (!IS_PRODUCTION) {
     console.error('❌ Error:', {
       message: error.message,
       stack: error.stack,
@@ -35,6 +48,16 @@ export const errorHandler: ErrorRequestHandler = (
   }
 
   // Handle different types of errors
+  const bodyError = typeof err.type === 'string' ? BODY_PARSER_ERRORS[err.type] : undefined;
+  if (bodyError) {
+    res.status(bodyError.statusCode).json({
+      status: 'error',
+      error: 'Invalid request',
+      message: bodyError.message,
+    });
+    return next();
+  }
+
   if (error.name === 'ValidationError') {
     res.status(400).json({
       status: 'error',
@@ -90,7 +113,7 @@ export const errorHandler: ErrorRequestHandler = (
   res.status(statusCode).json({
     status: 'error',
     message: 'Something went wrong!',
-    ...(process.env.NODE_ENV === 'development' && {
+    ...(!IS_PRODUCTION && {
       error: error.message,
       stack: error.stack,
     }),
diff --git a/server/src/middleware/rateLimiting.ts b/server/src/middleware/rateLimiting.ts
index 53d9e18..c59474f 100644
--- a/server/src/middleware/rateLimiting.ts
+++ b/server/src/middleware/rateLimiting.ts
@@ -12,10 +12,6 @@ export const worksheetRateLimit = rateLimit({
   },
   standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
   legacyHeaders: false, // Disable the `X-RateLimit-*` headers
-  // Skip requests that don't consume resources
-  skip: req => {
-    return req.path === '/api/health';
-  },
 });
 
 // Progressive delay for worksheet requests to discourage rapid requests