diff --git a/task_list.md b/task_list.md new file mode 100644 index 0000000..e1da5da --- /dev/null +++ b/task_list.md @@ -0,0 +1,33 @@ +# Task List: Performance and Security Enhancements + +This document tracks the tasks performed to improve the performance and security of the application. + +## Completed Tasks + +### Security +* **SEC-001: Externalize Hardcoded Configuration** + * **Status:** Done + * **Description:** Moved hardcoded constants from `Port_Constant.java` to `application.properties`. This allows for easier configuration management without changing the Java code. The class was refactored to load these properties at startup while preserving the existing static access pattern to minimize code impact. + * **Files Affected:** + * `test17july-back-b/authsec_springboot/backend/src/main/java/com/realnet/utils/Port_Constant.java` + * `test17july-back-b/authsec_springboot/backend/src/main/resources/application.properties` + +* **SEC-002: Secure Storage of Sensitive Data** + * **Status:** Done + * **Description:** Replaced plaintext secrets (API keys, passwords) in `application.properties` with placeholders that can be populated from environment variables. This is a critical security improvement to prevent secrets from being committed to version control. + * **Files Affected:** + * `test17july-back-b/authsec_springboot/backend/src/main/resources/application.properties` + +* **SEC-003: Use Session Storage in Frontend** + * **Status:** Done + * **Description:** Modified `ForgotpassService` to use `sessionStorage` instead of `localStorage` for storing the user's email during the password reset process. `sessionStorage` is more secure as it's cleared when the session ends, reducing the risk of XSS attacks accessing stored data. + * **Files Affected:** + * `test17july-front-f/authsec_angular/frontend/angular-clarity-master/src/app/services/api/forgotpass.service.ts` + +## Pending Tasks + +* Review logging practices for sensitive information exposure. +* Analyze dependencies for known vulnerabilities. +* Implement CSRF protection if not already present and adequate. +* Review database query construction to prevent SQL injection (though using an ORM like Hibernate/JPA mitigates this). +* Performance analysis of database queries and API endpoints. diff --git a/test17july-back-b/authsec_springboot/backend/src/main/java/com/realnet/utils/Port_Constant.java b/test17july-back-b/authsec_springboot/backend/src/main/java/com/realnet/utils/Port_Constant.java index 65e6b6f..e7da172 100644 --- a/test17july-back-b/authsec_springboot/backend/src/main/java/com/realnet/utils/Port_Constant.java +++ b/test17july-back-b/authsec_springboot/backend/src/main/java/com/realnet/utils/Port_Constant.java @@ -1,15 +1,55 @@ package com.realnet.utils; +import javax.annotation.PostConstruct; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.stereotype.Component; + +@Component public class Port_Constant { - public final static String LOCAL_HOST = "43.205.154.152"; - public final static String FRONTEND_PORT_9191 = "30165"; - public static String SURE_SETU_DOMAIN = "http://34.198.218.30:30173"; + @Value("${app.local-host}") + private String localHost; - public final static String GITEA_IP_ADDRESS = "try.gitea"; - public final static String GITEA_PORT = "io"; - public final static String SURE_VAULT_DOMAIN = "http://54.92.243.148:30150"; - public final static String SUREVAULT_DEPLOYMENT_TYPE = "32"; + @Value("${app.frontend-port-9191}") + private String frontendPort9191; + + @Value("${app.sure-setu-domain}") + private String sureSetuDomain; + + @Value("${app.gitea-ip-address}") + private String giteaIpAddress; + + @Value("${app.gitea-port}") + private String giteaPort; + + @Value("${app.sure-vault-domain}") + private String sureVaultDomain; + + @Value("${app.surevault-deployment-type}") + private String surevaultDeploymentType; + + @Value("${app.frontend-portal-domain:}") + private String frontendPortalDomain; + + public static String LOCAL_HOST; + public static String FRONTEND_PORT_9191; + public static String SURE_SETU_DOMAIN; + public static String GITEA_IP_ADDRESS; + public static String GITEA_PORT; + public static String SURE_VAULT_DOMAIN; + public static String SUREVAULT_DEPLOYMENT_TYPE; public static String FRONTEND_PORTAL_DOMAIN; + @PostConstruct + public void init() { + LOCAL_HOST = localHost; + FRONTEND_PORT_9191 = frontendPort9191; + SURE_SETU_DOMAIN = sureSetuDomain; + GITEA_IP_ADDRESS = giteaIpAddress; + GITEA_PORT = giteaPort; + SURE_VAULT_DOMAIN = sureVaultDomain; + SUREVAULT_DEPLOYMENT_TYPE = surevaultDeploymentType; + FRONTEND_PORTAL_DOMAIN = frontendPortalDomain; + } + } diff --git a/test17july-back-b/authsec_springboot/backend/src/main/resources/application.properties b/test17july-back-b/authsec_springboot/backend/src/main/resources/application.properties index 1096fe1..57c5fcb 100644 --- a/test17july-back-b/authsec_springboot/backend/src/main/resources/application.properties +++ b/test17july-back-b/authsec_springboot/backend/src/main/resources/application.properties @@ -12,7 +12,7 @@ springfox.documentation.swagger.v2.path=/api-docs spring.jackson.date-format=yyyy-MM-dd chatgpt.api.url=https://api.openai.com/v1/completions -chatgpt.api.key=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 +chatgpt.api.key=${CHATGPT_API_KEY} @@ -26,7 +26,7 @@ System.Net.ServicePointManager.Expect100Continue = false; spring.datasource.url=jdbc:mysql://157.66.191.31:3306/db?createDatabaseIfNotExist=true spring.datasource.username=cnsdev -spring.datasource.password=cnsdev2407 +spring.datasource.password=${DB_PASSWORD} spring.datasource.driverClassName = com.mysql.cj.jdbc.Driver @@ -39,13 +39,13 @@ spring.jpa.properties.hibernate.format_sql=true spring.jpa.properties.hibernate.proc.param_null_passing=true # **********paytm dependency ****** -razorpay.api.key=rzp_test_xVnrBUjJWTEH0r -razorpay.api.secret=evTXkIFcgpVtiLa1P7M7CIox +razorpay.api.key=${RAZORPAY_API_KEY} +razorpay.api.secret=${RAZORPAY_API_SECRET} #***** MAIL SENDER spring.mail.host=smtp.gmail.com spring.mail.username=realitmailsender@gmail.com -spring.mail.password=epnmhzsccotnyozf +spring.mail.password=${MAIL_PASSWORD} spring.mail.port=587 #spring.mail.properties.mail.smtp.auth=true spring.mail.properties.mail.smtp.starttls.enable=true @@ -68,7 +68,7 @@ spring.servlet.multipart.max-request-size=100MB #***************OAUTH2 SOCIAL LOGIN ********* # Social login provider props spring.security.oauth2.client.registration.google.clientId=437023664181-0lm0ipgip3qbhga4nd7o4128jv4g2nv9.apps.googleusercontent.com -spring.security.oauth2.client.registration.google.clientSecret=I1HPyUqdJ9UONu45W1_wwfww +spring.security.oauth2.client.registration.google.clientSecret=${GOOGLE_CLIENT_SECRET} spring.security.oauth2.client.registration.google.scope=profile, email @@ -85,7 +85,7 @@ spring.security.oauth2.client.provider.linkedin.token-uri=https://www.linkedin.c spring.security.oauth2.client.provider.linkedin.user-info-uri=https://api.linkedin.com/v2/me spring.security.oauth2.client.provider.linkedin.user-name-attribute=id linkedin.email-address-uri=https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~)) -app.auth.tokenSecret=926D96C90030DD58429D2751AC1BDBBC +app.auth.tokenSecret=${APP_AUTH_TOKEN_SECRET} app.auth.tokenExpirationMsec=864000000 # After successfully authenticating with the OAuth2 Provider, # we'll be generating an auth token for the user and sending the token to the @@ -95,4 +95,4 @@ app.oauth2.authorizedRedirectUris=http://localhost:8081/oauth2/redirect,myandroi projectPath=@project.basedir@ -angularProjectPath=@project.basedir@/webui \ No newline at end of file +angularProjectPath=@project.basedir@/webui diff --git a/test17july-front-f/authsec_angular/frontend/angular-clarity-master/src/app/services/api/forgotpass.service.ts b/test17july-front-f/authsec_angular/frontend/angular-clarity-master/src/app/services/api/forgotpass.service.ts index 8176718..08d05c2 100644 --- a/test17july-front-f/authsec_angular/frontend/angular-clarity-master/src/app/services/api/forgotpass.service.ts +++ b/test17july-front-f/authsec_angular/frontend/angular-clarity-master/src/app/services/api/forgotpass.service.ts @@ -6,21 +6,21 @@ import baseUrl from '../api/helper'; }) export class ForgotpassService { private url = "api/forgot"; - public localStorage: Storage = localStorage; + public storage: Storage = sessionStorage; constructor(private http: HttpClient,) { } checkMailExists(email: string) { return this.http.post(this.url+ "check-email", {"email": email}); } storeEmail(userInfoString: string) { - this.localStorage.setItem("registeredEmail", userInfoString); + this.storage.setItem("registeredEmail", userInfoString); } //Store userinfo from session storage //Get email from session storage ( WILL REMOVE AFTER REGISTER) getStoredEmail(): string | null { try { - let userInfoString: string = this.localStorage.getItem( + let userInfoString: string = this.storage.getItem( "registeredEmail" ); if (userInfoString) {