Skip to main content Skills Marktplatz Entdecken und erkunden Sie KI-Skills, die von der Community erstellt wurden.
Verwandte Berufe SOC
Basierend auf der SOC-Berufsklassifikation
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Prompt-Details anzeigen Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/pluginagentmarketplace/custom-plugin-api-design --skill security-patternsDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
ZIP herunterladen Herunterladen... Mehr aus diesem Repository name security-patterns version 2.0.0 description Security architecture, authentication, authorization, and compliance patterns sasmp_version 1.3.0 bonded_agent 05-security-compliance bond_type PRIMARY_BOND atomic_design {"single_responsibility":"API security patterns and compliance","boundaries":{"includes":["authentication","authorization","encryption","rate_limiting","input_validation"],"excludes":["infrastructure_security","network_security","physical_security"]}} parameter_validation {"schema":{"type":"object","properties":{"auth_type":{"type":"string","enum":["jwt","oauth2","api_key","session"]},"access_control":{"type":"string","enum":["rbac","abac","policy"]},"compliance":{"type":"array","items":{"type":"string","enum":["gdpr","hipaa","pci_dss","soc2"]}}}}} retry_config {"enabled":false} logging {"level":"INFO","fields":["auth_type","user_id","action","resource","result"],"sensitive_fields_redacted":["password","token","api_key"]} dependencies {"skills":[],"agents":["05-security-compliance"]}
Security Patterns Skill
Purpose
Implement comprehensive security for APIs following OWASP guidelines.
Authentication Patterns
JWT Implementation
import jwt from 'jsonwebtoken' ;
interface TokenPayload {
sub : string ;
roles : string [];
iat : number ;
exp : number ;
jti : string ;
}
class JWTService {
private readonly secret = process.env .JWT_SECRET !;
private readonly accessTTL = '15m' ;
private readonly refreshTTL = '7d' ;
generateTokenPair (user : User const jti = crypto.randomUUID ();
const accessToken = jwt.sign (
{ sub : user.id , roles : user.roles , jti },
this .secret ,
{ expiresIn : this .accessTTL , issuer : 'api.example.com' }
);
const
sign
sub
id
type
'refresh'
this
secret
expiresIn
this
refreshTTL
return
verify
token
string
TokenPayload
return
verify
this
secret
issuer
'api.example.com'
as
TokenPayload
async
isRevoked
jti
string
Promise
boolean
return
await
exists
`revoked:${jti} `
OAuth 2.0 + PKCE Flow
function generatePKCE (const verifier = crypto.randomBytes (32 ).toString ('base64url' );
const challenge = crypto
.createHash ('sha256' )
.update (verifier)
.digest ('base64url' );
return { verifier, challenge };
}
const authUrl = new URL ('https://auth.example.com/authorize' );
authUrl.searchParams .set ('client_id' , CLIENT_ID );
authUrl.searchParams .set ('redirect_uri' , REDIRECT_URI );
authUrl.searchParams .set ('response_type' , 'code' );
authUrl.searchParams .set ('scope' , 'openid profile email' );
authUrl.searchParams .set ('code_challenge' , challenge);
authUrl.searchParams .set ('code_challenge_method' , 'S256' );
authUrl.searchParams .set ('state' , state);
async function exchangeCode (code : string , verifier : string const response = await fetch ('https://auth.example.com/token' , {
method : 'POST' ,
headers : { 'Content-Type' : 'application/x-www-form-urlencoded' },
body : new URLSearchParams ({
grant_type : 'authorization_code' ,
client_id : CLIENT_ID ,
code,
redirect_uri : REDIRECT_URI ,
code_verifier : verifier,
}),
});
return response.json ();
}
Authorization Patterns
RBAC Middleware type Permission = 'read' | 'write' | 'delete' | 'admin' ;
type Resource = 'users' | 'orders' | 'products' ;
const rolePermissions : Record <string , Record <Resource , Permission []>> = {
admin : {
users : ['read' , 'write' , 'delete' , 'admin' ],
orders : ['read' , 'write' , 'delete' , 'admin' ],
products : ['read' , 'write' , 'delete' , 'admin' ],
},
manager : {
users : ['read' ],
orders : ['read' , 'write' ],
products : ['read' , 'write' ],
},
user : {
users : ['read' ],
orders : ['read' ],
products : ['read' ],
},
};
function requirePermission (resource : Resource , permission : Permission return (req : Request , res : Response , next : NextFunction {
const userRoles = req.user ?.roles || [];
const hasPermission = userRoles.some (role =>const perms = rolePermissions[role]?.[resource] || [];
return perms.includes (permission);
});
if (!hasPermission) {
return res.status (403 ).json ({
type : 'https://api.example.com/errors/forbidden' ,
title : 'Forbidden' ,
status : 403 ,
detail : `Missing permission: ${permission} on ${resource} ` ,
});
}
next ();
};
}
app.delete ('/users/:id' ,
authenticate,
requirePermission ('users' , 'delete' ),
deleteUser
);
ABAC Policy Engine interface Policy {
effect : 'allow' | 'deny' ;
actions : string [];
resources : string [];
conditions ?: Condition [];
}
interface Condition {
field : string ;
operator : 'eq' | 'neq' | 'in' | 'contains' ;
value : any ;
}
class PolicyEngine {
private policies : Policy [] = [];
evaluate (context : {
user : User ;
action : string ;
resource : string ;
environment : Record <string , any >;
}): boolean {
for (const policy of this .policies ) {
if (!policy.actions .includes (context.action )) continue ;
if (!this .matchResource (policy.resources , context.resource )) continue ;
if (!this .evaluateConditions (policy.conditions , context)) continue ;
return policy.effect === 'allow' ;
}
return false ;
}
private evaluateConditions (conditions : Condition [] | undefined , context : any ): boolean {
if (!conditions) return true ;
return conditions.every (cond =>const value = this .getNestedValue (context, cond.field );
switch (cond.operator ) {
case 'eq' : return value === cond.value ;
case 'neq' : return value !== cond.value ;
case 'in' : return cond.value .includes (value);
case 'contains' : return value?.includes (cond.value );
default : return false ;
}
});
}
}
Input Validation & Sanitization import { z } from 'zod' ;
import xss from 'xss' ;
import SqlString from 'sqlstring' ;
const CreateUserSchema = z.object ({
email : z.string ().email ().max (255 ),
name : z.string ().min (1 ).max (100 ).transform (val =>xss (val)),
password : z.string ()
.min (12 )
.regex (/[A-Z]/ , 'Must contain uppercase' )
.regex (/[a-z]/ , 'Must contain lowercase' )
.regex (/[0-9]/ , 'Must contain number' )
.regex (/[^A-Za-z0-9]/ , 'Must contain special character' ),
});
function safeQuery (template : TemplateStringsArray , ...values : any []return template.reduce ((acc, str, i ) => {
return acc + str + (values[i] !== undefined ? SqlString .escape (values[i]) : '' );
}, '' );
}
const sql = safeQuery`SELECT * FROM users WHERE id = ${userId} ` ;
Rate Limiting import rateLimit from 'express-rate-limit' ;
import RedisStore from 'rate-limit-redis' ;
const rateLimits = {
anonymous : rateLimit ({
windowMs : 15 * 60 * 1000 ,
max : 100 ,
standardHeaders : true ,
legacyHeaders : false ,
store : new RedisStore ({ prefix : 'rl:anon:' }),
}),
authenticated : rateLimit ({
windowMs : 15 * 60 * 1000 ,
max : 1000 ,
keyGenerator : (req ) => req.user ?.id || req.ip ,
store : new RedisStore ({ prefix : 'rl:auth:' }),
}),
sensitive : rateLimit ({
windowMs : 60 * 60 * 1000 ,
max : 10 ,
keyGenerator : (req ) => req.ip ,
store : new RedisStore ({ prefix : 'rl:sens:' }),
}),
};
app.post ('/login' , rateLimits.sensitive , loginHandler);
app.use ('/api' , authenticate, rateLimits.authenticated );
Security Headers import helmet from 'helmet' ;
app.use (helmet ({
contentSecurityPolicy : {
directives : {
defaultSrc : ["'self'" ],
scriptSrc : ["'self'" ],
styleSrc : ["'self'" , "'unsafe-inline'" ],
imgSrc : ["'self'" , "data:" , "https:" ],
connectSrc : ["'self'" , "https://api.example.com" ],
},
},
hsts : {
maxAge : 31536000 ,
includeSubDomains : true ,
preload : true ,
},
referrerPolicy : { policy : 'strict-origin-when-cross-origin' },
}));
app.use ((req, res, next ) => {
res.setHeader ('X-Content-Type-Options' , 'nosniff' );
res.setHeader ('X-Frame-Options' , 'DENY' );
res.setHeader ('Permissions-Policy' , 'geolocation=(), microphone=()' );
next ();
});
Unit Test Template import { describe, it, expect } from 'vitest' ;
import request from 'supertest' ;
import app from './app' ;
describe ('Security Patterns' , () => {
describe ('Authentication' , () => {
it ('should reject invalid JWT' , async () => {
await request (app)
.get ('/api/users' )
.set ('Authorization' , 'Bearer invalid-token' )
.expect (401 );
});
it ('should accept valid JWT' , async () => {
const token = generateTestToken ({ sub : '123' , roles : ['user' ] });
await request (app)
.get ('/api/users' )
.set ('Authorization' , `Bearer ${token} ` )
.expect (200 );
});
});
describe ('Authorization' , () => {
it ('should enforce RBAC permissions' , async () => {
const userToken = generateTestToken ({ sub : '123' , roles : ['user' ] });
await request (app)
.delete ('/api/users/456' )
.set ('Authorization' , `Bearer ${userToken} ` )
.expect (403 );
});
});
describe ('Input Validation' , () => {
it ('should reject XSS attempts' , async () => {
const res = await request (app)
.post ('/api/users' )
.send ({ name : '<script>alert("xss")</script>' , email : 'test@test.com' });
expect (res.body .data ?.name ).not .toContain ('<script>' );
});
it ('should reject SQL injection' , async () => {
await request (app)
.get ('/api/users?id=1; DROP TABLE users;--' )
.expect (400 );
});
});
describe ('Rate Limiting' , () => {
it ('should block after threshold' , async () => {
for (let i = 0 ; i < 10 ; i++) {
await request (app).post ('/login' ).send ({ email : 'test@test.com' , password : 'wrong' });
}
const res = await request (app)
.post ('/login' )
.send ({ email : 'test@test.com' , password : 'wrong' });
expect (res.status ).toBe (429 );
});
});
});
Troubleshooting Issue Cause Solution JWT expired prematurely Clock skew Add leeway (30s) to verification CORS blocked Missing headers Configure allowed origins properly Rate limit too aggressive Shared IP (NAT) Use user ID for authenticated requests Token leaked Stored insecurely Use httpOnly cookies, short TTL XSS vulnerability Unsanitized output Always escape user content
OWASP Top 10 Checklist
Quality Checklist 