`auction-viewer/SECURITY_QUICKREF.md`

111 lines
# LUXVAULT Security Quick Reference

## Access URLs
- **Production:** http://45.61.58.125:7500
- **Health Check:** http://45.61.58.125:7500/health
- **Status:** http://45.61.58.125:7500/api/status

## Rate Limits
| Endpoint Type | Limit | Window | Reset |
|--------------|-------|--------|-------|
| General API | 100 requests | 15 min | Automatic |
| Strict (/logs, /csv) | 20 requests | 5 min | Automatic |
| Downloads | 10 requests | 1 hour | Automatic |

## Security Headers Applied
```
✅ Content-Security-Policy
✅ Strict-Transport-Security (HSTS)
✅ X-Frame-Options: SAMEORIGIN
✅ X-Content-Type-Options: nosniff
✅ X-XSS-Protection: 0 (CSP enabled)
✅ Referrer-Policy: strict-origin-when-cross-origin
```

## Input Validation Rules
- **limit:** 1-1000 (integer)
- **offset:** >=0 (integer)
- **sort:** 'percent' | 'dollar'
- **lines:** 1-500 (integer)

## File Size Limits
- Request body: 10MB
- Log file read: 50MB
- CSV download: 50MB
- CSV API read: 10MB

## Log Files
```bash
# View security events
tail -f /root/Projects/handbag-auth-nextjs/auction-viewer/logs/security.log

# View errors
tail -f /root/Projects/handbag-auth-nextjs/auction-viewer/logs/error.log

# View all logs
tail -f /root/Projects/handbag-auth-nextjs/auction-viewer/logs/combined.log
```

## PM2 Commands
```bash
# Check status
pm2 status auction-viewer

# View logs
pm2 logs auction-viewer

# Restart
pm2 restart auction-viewer

# Stop
pm2 stop auction-viewer
```

## Test Security
```bash
# Run security tests
node /root/Projects/handbag-auth-nextjs/auction-viewer/test-security.js

# Test rate limiting
for i in {1..25}; do curl -s http://45.61.58.125:7500/api/logs; done

# Check security headers
curl -I http://45.61.58.125:7500 | grep -E '(Security|Frame|Content-Type)'
```

## Environment Variables
Key security settings in `.env`:
- `NODE_ENV=production`
- `API_RATE_LIMIT=100`
- `STRICT_RATE_LIMIT=20`
- `LOG_LEVEL=info`
- `HSTS_MAX_AGE=31536000`

## Emergency Procedures

### If rate limited:
Wait for window to reset (5-15 minutes depending on endpoint)

### If server crashes:
```bash
pm2 restart auction-viewer
pm2 save
```

### To disable rate limiting (emergency only):
Comment out rate limiter middleware in server-secured.js

### To check for attacks:
```bash
# Check rate limit violations
grep "Rate limit" /root/Projects/handbag-auth-nextjs/auction-viewer/logs/security.log

# Check CORS violations
grep "CORS violation" /root/Projects/handbag-auth-nextjs/auction-viewer/logs/security.log

# Check 404s (possible scanning)
grep "404 Not Found" /root/Projects/handbag-auth-nextjs/auction-viewer/logs/security.log
```

---
Last Updated: November 17, 2025