🔴 Where to work
Primary files to edit:
api/src/common/guards/auth.guard.ts [REWRITE] — currently reads X-User-Id header (line 28). Rewrite to verify JWT from Authorization: Bearer header using Passport strategy.api/src/common/guards/stream-ownership.guard.ts [EDIT] — same X-User-Id pattern (line 30). Update to extract user from validated JWT.
New files to create:
api/src/auth/jwt.strategy.ts [NEW] — Passport JWT strategy extending PassportStrategy(Strategy)api/src/auth/jwt-auth.guard.ts [NEW] — guard extending AuthGuard('jwt')
Files to update:
api/src/auth/auth.module.ts [EDIT] — add PassportModule importapi/src/streams/streams.module.ts [EDIT] — update guard imports to JWT versionsapi/src/tags/tags.module.ts [EDIT] — update guard imports to JWT versionsapi/src/gateways/streams.gateway.ts [VERIFY] — already does JWT verification independently, ensure uses same strategy
Reference patterns:
api/src/auth/auth.service.ts — JwtService.sign() already creates valid tokensapi/src/auth/auth.module.ts — JwtModule already registered
Problem Statement
The AuthGuard at api/src/common/guards/auth.guard.ts:28 reads user identity from X-User-Id header with zero verification: const rawUserId = (req.header("x-user-id") ?? "").trim(). Any caller can impersonate any user. Exploit: curl -H "X-User-Id: 1" http://localhost:3001/streams.
Acceptance Criteria
Testing Strategy
- Unit: Test JwtStrategy.validate() with valid/invalid/expired tokens
- Unit: Test JwtAuthGuard.canActivate() with valid/missing/malformed headers
- Integration: Full POST /auth/login → GET /streams flow
- Negative: Expired token, wrong secret, missing header, malformed token
Security Considerations
Primary security fix. Follow OWASP authentication best practices. JWT secret from environment only. Token expiry enforced. Use sub claim as user identifier.
🔴 Where to work
Primary files to edit:
api/src/common/guards/auth.guard.ts[REWRITE] — currently readsX-User-Idheader (line 28). Rewrite to verify JWT fromAuthorization: Bearerheader using Passport strategy.api/src/common/guards/stream-ownership.guard.ts[EDIT] — sameX-User-Idpattern (line 30). Update to extract user from validated JWT.New files to create:
api/src/auth/jwt.strategy.ts[NEW] — Passport JWT strategy extendingPassportStrategy(Strategy)api/src/auth/jwt-auth.guard.ts[NEW] — guard extendingAuthGuard('jwt')Files to update:
api/src/auth/auth.module.ts[EDIT] — addPassportModuleimportapi/src/streams/streams.module.ts[EDIT] — update guard imports to JWT versionsapi/src/tags/tags.module.ts[EDIT] — update guard imports to JWT versionsapi/src/gateways/streams.gateway.ts[VERIFY] — already does JWT verification independently, ensure uses same strategyReference patterns:
api/src/auth/auth.service.ts— JwtService.sign() already creates valid tokensapi/src/auth/auth.module.ts— JwtModule already registeredProblem Statement
The AuthGuard at
api/src/common/guards/auth.guard.ts:28reads user identity fromX-User-Idheader with zero verification:const rawUserId = (req.header("x-user-id") ?? "").trim(). Any caller can impersonate any user. Exploit:curl -H "X-User-Id: 1" http://localhost:3001/streams.Acceptance Criteria
Testing Strategy
Security Considerations
Primary security fix. Follow OWASP authentication best practices. JWT secret from environment only. Token expiry enforced. Use
subclaim as user identifier.