+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Home / Tutorials / 📘 typescript
Part 228 of 355

🔒 Security Testing: OWASP Compliance

Master security testing: owasp compliance in TypeScript with practical examples, best practices, and real-world applications 🚀

🚀Intermediate
30 min read

Prerequisites

  • Basic understanding of JavaScript 📝
  • TypeScript installation ⚡
  • VS Code or preferred IDE 💻

What you'll learn

  • Understand security testing fundamentals 🎯
  • Apply OWASP principles in real projects 🏗️
  • Debug common security issues 🐛
  • Write type-safe secure code ✨

🎯 Introduction

Welcome to the crucial world of security testing with TypeScript! 🛡️ In this guide, we’ll explore how to build applications that stand strong against security threats using OWASP (Open Web Application Security Project) principles.

You’ll discover how proper security testing can protect your TypeScript applications from the most common vulnerabilities. Whether you’re building web applications 🌐, APIs 🖥️, or full-stack systems 📚, understanding OWASP compliance is essential for creating secure, trustworthy software.

By the end of this tutorial, you’ll feel confident implementing robust security testing in your own projects! Let’s fortify your code! 🏰

📚 Understanding OWASP Security Testing

🤔 What is OWASP?

OWASP is like a security guard 🛡️ for your web applications. Think of it as a comprehensive guidebook 📖 that helps you identify and prevent the most dangerous security vulnerabilities that hackers love to exploit.

In TypeScript terms, OWASP provides a framework for identifying security risks and implementing protective measures ✨. This means you can:

  • ✨ Prevent injection attacks
  • 🚀 Secure authentication and session management
  • 🛡️ Protect sensitive data exposure
  • 🔒 Implement proper access controls

💡 Why Use OWASP Security Testing?

Here’s why developers prioritize OWASP compliance:

  1. Proven Framework 🔒: Battle-tested against real-world threats
  2. Industry Standard 💻: Recognized globally by security professionals
  3. Comprehensive Coverage 📖: Addresses top security vulnerabilities
  4. Community Support 🔧: Constantly updated by security experts

Real-world example: Imagine building an e-commerce platform 🛒. With OWASP compliance, you can protect customer payment data, prevent SQL injection, and secure user accounts against breaches.

🔧 Basic Security Testing Setup

📝 Essential Security Test Types

Let’s start with fundamental security testing patterns:

// 🛡️ Security testing utilities
interface SecurityTestConfig {
  enableSqlInjectionTests: boolean;    // 💉 SQL injection protection  
  enableXssTests: boolean;             // 🚫 Cross-site scripting protection
  enableCsrfTests: boolean;            // 🛡️ CSRF token validation
  enableAuthTests: boolean;            // 🔐 Authentication security
}

// 🎯 Security test framework
class SecurityTester {
  private config: SecurityTestConfig;
  
  constructor(config: SecurityTestConfig) {
    this.config = config;
    console.log("🚀 Security testing framework initialized!");
  }
  
  // 🧪 Run all security tests
  async runSecuritySuite(): Promise<SecurityTestResult[]> {
    const results: SecurityTestResult[] = [];
    
    if (this.config.enableSqlInjectionTests) {
      results.push(await this.testSqlInjection());
    }
    
    if (this.config.enableXssTests) {
      results.push(await this.testXssVulnerabilities());
    }
    
    return results;
  }
}

💡 Explanation: Notice how we structure security tests systematically! Each test type can be enabled/disabled for targeted testing scenarios.

🎯 Input Validation Testing

Here are patterns you’ll use to prevent injection attacks:

// ⚠️ Input validation for security
interface ValidationResult {
  isValid: boolean;
  errors: string[];
  sanitizedInput?: string;
}

// 🛡️ Secure input validator
class SecureInputValidator {
  
  // 💉 Prevent SQL injection
  validateSqlInput(input: string): ValidationResult {
    const sqlInjectionPattern = /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b)/i;
    
    if (sqlInjectionPattern.test(input)) {
      return {
        isValid: false,
        errors: ["🚨 Potential SQL injection detected!"]
      };
    }
    
    return {
      isValid: true,
      errors: [],
      sanitizedInput: this.sanitizeInput(input)
    };
  }
  
  // 🚫 Prevent XSS attacks
  validateXssInput(input: string): ValidationResult {
    const xssPattern = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
    
    if (xssPattern.test(input)) {
      return {
        isValid: false,
        errors: ["🚨 Potential XSS attempt detected!"]
      };
    }
    
    return {
      isValid: true,
      errors: [],
      sanitizedInput: this.escapeHtml(input)
    };
  }
  
  // 🧹 Sanitize dangerous input
  private sanitizeInput(input: string): string {
    return input.replace(/['"`;\\]/g, ''); // 🧽 Remove dangerous characters
  }
  
  // 🛡️ Escape HTML entities
  private escapeHtml(input: string): string {
    return input
      .replace(/&/g, '&amp;')
      .replace(/</g, '&lt;')
      .replace(/>/g, '&gt;')
      .replace(/"/g, '&quot;')
      .replace(/'/g, '&#x27;');
  }
}

💡 Practical Security Testing Examples

🛒 Example 1: E-Commerce Security Testing

Let’s build a secure shopping system:

// 🛍️ Secure user interface
interface SecureUser {
  id: string;
  email: string;
  hashedPassword: string; // 🔐 Never store plain passwords!
  role: 'customer' | 'admin';
  sessionToken?: string;
}

// 💳 Secure payment data
interface SecurePayment {
  transactionId: string;
  amount: number;
  currency: string;
  encryptedCardData: string; // 🛡️ Always encrypt sensitive data
  timestamp: Date;
}

// 🔒 Secure e-commerce class with built-in testing
class SecureECommerceSystem {
  private users: Map<string, SecureUser> = new Map();
  private validator = new SecureInputValidator();
  
  // 🔐 Secure user registration
  async registerUser(email: string, password: string): Promise<{success: boolean, errors: string[]}> {
    // 📧 Validate email format
    const emailValidation = this.validateEmail(email);
    if (!emailValidation.isValid) {
      return { success: false, errors: emailValidation.errors };
    }
    
    // 🔑 Validate password strength
    const passwordValidation = this.validatePasswordStrength(password);
    if (!passwordValidation.isValid) {
      return { success: false, errors: passwordValidation.errors };
    }
    
    // 🧂 Hash password with salt
    const hashedPassword = await this.hashPassword(password);
    
    const user: SecureUser = {
      id: this.generateSecureId(),
      email: email.toLowerCase().trim(),
      hashedPassword,
      role: 'customer'
    };
    
    this.users.set(user.id, user);
    console.log(`✅ User registered securely: ${user.email}`);
    
    return { success: true, errors: [] };
  }
  
  // 💳 Secure payment processing
  async processPayment(userId: string, paymentData: Omit<SecurePayment, 'transactionId' | 'encryptedCardData' | 'timestamp'>): Promise<{success: boolean, transactionId?: string}> {
    // 🔍 Validate user exists and is authenticated
    const user = this.users.get(userId);
    if (!user || !user.sessionToken) {
      console.log("🚨 Unauthorized payment attempt!");
      return { success: false };
    }
    
    // 💰 Validate payment amount
    if (paymentData.amount <= 0 || paymentData.amount > 10000) {
      console.log("⚠️ Invalid payment amount detected!");
      return { success: false };
    }
    
    // 🔐 Create secure transaction
    const transaction: SecurePayment = {
      transactionId: this.generateSecureId(),
      ...paymentData,
      encryptedCardData: "ENCRYPTED_DATA_PLACEHOLDER", // 🛡️ Would use real encryption
      timestamp: new Date()
    };
    
    console.log(`💸 Payment processed securely: $${paymentData.amount}`);
    return { success: true, transactionId: transaction.transactionId };
  }
  
  // 🔑 Password strength validation
  private validatePasswordStrength(password: string): ValidationResult {
    const errors: string[] = [];
    
    if (password.length < 8) {
      errors.push("🚨 Password must be at least 8 characters");
    }
    
    if (!/[A-Z]/.test(password)) {
      errors.push("🚨 Password must contain uppercase letters");
    }
    
    if (!/[0-9]/.test(password)) {
      errors.push("🚨 Password must contain numbers");
    }
    
    if (!/[!@#$%^&*]/.test(password)) {
      errors.push("🚨 Password must contain special characters");
    }
    
    return {
      isValid: errors.length === 0,
      errors
    };
  }
  
  // 📧 Email validation
  private validateEmail(email: string): ValidationResult {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
    
    if (!emailRegex.test(email)) {
      return {
        isValid: false,
        errors: ["🚨 Invalid email format"]
      };
    }
    
    return { isValid: true, errors: [] };
  }
  
  // 🎲 Generate cryptographically secure IDs
  private generateSecureId(): string {
    return `secure_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  }
  
  // 🔐 Hash password (placeholder for real hashing)
  private async hashPassword(password: string): Promise<string> {
    // 🧂 In real implementation, use bcrypt or argon2
    return `hashed_${password}_with_salt`;
  }
}

🎯 Try it yourself: Add a session timeout feature and brute-force attack protection!

🧪 Example 2: Security Test Suite

Let’s create comprehensive security tests:

// 🧪 Security test result interface
interface SecurityTestResult {
  testName: string;
  passed: boolean;
  vulnerabilities: string[];
  recommendations: string[];
  severity: 'low' | 'medium' | 'high' | 'critical';
}

// 🔍 Comprehensive security test suite
class OWASPSecurityTestSuite {
  private system: SecureECommerceSystem;
  
  constructor(system: SecureECommerceSystem) {
    this.system = system;
  }
  
  // 🧪 Run complete OWASP security test suite
  async runCompleteSecurityAudit(): Promise<SecurityTestResult[]> {
    console.log("🚀 Starting OWASP security audit...");
    
    const results: SecurityTestResult[] = [];
    
    // A1: Injection Testing
    results.push(await this.testSqlInjectionPrevention());
    
    // A2: Authentication Testing  
    results.push(await this.testAuthenticationSecurity());
    
    // A3: Sensitive Data Exposure
    results.push(await this.testDataEncryption());
    
    // A7: Cross-Site Scripting (XSS)
    results.push(await this.testXssPrevention());
    
    console.log("✅ Security audit completed!");
    this.generateSecurityReport(results);
    
    return results;
  }
  
  // 💉 Test SQL injection prevention
  private async testSqlInjectionPrevention(): Promise<SecurityTestResult> {
    const maliciousInputs = [
      "'; DROP TABLE users; --",
      "admin' OR '1'='1",
      "UNION SELECT * FROM sensitive_data"
    ];
    
    const vulnerabilities: string[] = [];
    
    for (const input of maliciousInputs) {
      const validator = new SecureInputValidator();
      const result = validator.validateSqlInput(input);
      
      if (result.isValid) {
        vulnerabilities.push(`🚨 SQL injection bypassed with: ${input}`);
      }
    }
    
    return {
      testName: "🛡️ SQL Injection Prevention",
      passed: vulnerabilities.length === 0,
      vulnerabilities,
      recommendations: vulnerabilities.length > 0 ? [
        "🔧 Implement parameterized queries",
        "🧹 Add input sanitization",
        "🛡️ Use ORM with built-in protection"
      ] : [],
      severity: vulnerabilities.length > 0 ? 'critical' : 'low'
    };
  }
  
  // 🔐 Test authentication security
  private async testAuthenticationSecurity(): Promise<SecurityTestResult> {
    const vulnerabilities: string[] = [];
    
    // 🔑 Test weak password acceptance
    const weakPasswords = ["123456", "password", "admin"];
    
    for (const weakPassword of weakPasswords) {
      const result = await this.system.registerUser("[email protected]", weakPassword);
      
      if (result.success) {
        vulnerabilities.push(`🚨 Weak password accepted: ${weakPassword}`);
      }
    }
    
    return {
      testName: "🔐 Authentication Security",
      passed: vulnerabilities.length === 0,
      vulnerabilities,
      recommendations: vulnerabilities.length > 0 ? [
        "🔒 Enforce strong password policies",
        "🕐 Implement account lockout after failed attempts",
        "🔐 Add two-factor authentication"
      ] : [],
      severity: vulnerabilities.length > 0 ? 'high' : 'low'
    };
  }
  
  // 🔒 Test data encryption
  private async testDataEncryption(): Promise<SecurityTestResult> {
    const vulnerabilities: string[] = [];
    
    // 🔍 This would test if sensitive data is properly encrypted
    // For demonstration, we'll check if passwords are hashed
    const testUser = await this.system.registerUser("[email protected]", "SecurePass123!");
    
    if (testUser.success) {
      console.log("✅ Password hashing verified");
    } else {
      vulnerabilities.push("🚨 Password not properly secured");
    }
    
    return {
      testName: "🔒 Data Encryption",
      passed: vulnerabilities.length === 0,
      vulnerabilities,
      recommendations: vulnerabilities.length > 0 ? [
        "🛡️ Encrypt sensitive data at rest",
        "🔐 Use HTTPS for data in transit",
        "🧂 Salt and hash passwords properly"
      ] : [],
      severity: vulnerabilities.length > 0 ? 'critical' : 'low'
    };
  }
  
  // 🚫 Test XSS prevention
  private async testXssPrevention(): Promise<SecurityTestResult> {
    const xssPayloads = [
      "<script>alert('XSS')</script>",
      "<img src=x onerror=alert('XSS')>",
      "javascript:alert('XSS')"
    ];
    
    const vulnerabilities: string[] = [];
    const validator = new SecureInputValidator();
    
    for (const payload of xssPayloads) {
      const result = validator.validateXssInput(payload);
      
      if (result.isValid) {
        vulnerabilities.push(`🚨 XSS payload not blocked: ${payload}`);
      }
    }
    
    return {
      testName: "🚫 Cross-Site Scripting Prevention",
      passed: vulnerabilities.length === 0,
      vulnerabilities,
      recommendations: vulnerabilities.length > 0 ? [
        "🧹 Sanitize all user inputs",
        "🛡️ Implement Content Security Policy",
        "✨ Use proper output encoding"
      ] : [],
      severity: vulnerabilities.length > 0 ? 'high' : 'low'
    };
  }
  
  // 📊 Generate security report
  private generateSecurityReport(results: SecurityTestResult[]): void {
    console.log("\n📊 OWASP Security Audit Report");
    console.log("================================");
    
    const totalTests = results.length;
    const passedTests = results.filter(r => r.passed).length;
    const criticalIssues = results.filter(r => r.severity === 'critical').length;
    
    console.log(`📋 Total Tests: ${totalTests}`);
    console.log(`✅ Passed: ${passedTests}`);
    console.log(`❌ Failed: ${totalTests - passedTests}`);
    console.log(`🚨 Critical Issues: ${criticalIssues}`);
    
    if (criticalIssues === 0 && passedTests === totalTests) {
      console.log("🎉 All security tests passed! Your application is secure! 🛡️");
    } else {
      console.log("⚠️ Security improvements needed. Review recommendations above.");
    }
  }
}

🚀 Advanced Security Testing

🧙‍♂️ Advanced Topic 1: Automated Security Scanning

When you’re ready to level up, try automated security testing:

// 🔍 Automated security scanner
interface SecurityScanConfig {
  enableStaticAnalysis: boolean;
  enableDependencyCheck: boolean;
  enablePenetrationTest: boolean;
  scanDepth: 'shallow' | 'medium' | 'deep';
}

class AutomatedSecurityScanner {
  private config: SecurityScanConfig;
  
  constructor(config: SecurityScanConfig) {
    this.config = config;
  }
  
  // 🤖 Run automated security scan
  async performAutomatedScan(codebase: string[]): Promise<SecurityScanResult> {
    console.log("🤖 Starting automated security scan...");
    
    const findings: SecurityFinding[] = [];
    
    if (this.config.enableStaticAnalysis) {
      findings.push(...await this.runStaticAnalysis(codebase));
    }
    
    if (this.config.enableDependencyCheck) {
      findings.push(...await this.checkDependencyVulnerabilities());
    }
    
    return {
      timestamp: new Date(),
      totalFindings: findings.length,
      criticalFindings: findings.filter(f => f.severity === 'critical').length,
      findings,
      overallScore: this.calculateSecurityScore(findings)
    };
  }
  
  // 🔍 Static code analysis
  private async runStaticAnalysis(codebase: string[]): Promise<SecurityFinding[]> {
    const findings: SecurityFinding[] = [];
    
    for (const file of codebase) {
      // 🚨 Check for hardcoded secrets
      if (file.includes('password') || file.includes('api_key')) {
        findings.push({
          type: 'hardcoded_secret',
          severity: 'critical',
          description: '🚨 Potential hardcoded secret detected',
          recommendation: '🔐 Use environment variables for secrets'
        });
      }
      
      // ⚠️ Check for console.log in production
      if (file.includes('console.log')) {
        findings.push({
          type: 'information_disclosure',
          severity: 'medium',
          description: '⚠️ Console logging in production code',
          recommendation: '🧹 Remove debug statements from production'
        });
      }
    }
    
    return findings;
  }
  
  // 📦 Check dependency vulnerabilities
  private async checkDependencyVulnerabilities(): Promise<SecurityFinding[]> {
    // 🔍 This would integrate with npm audit or similar tools
    return [
      {
        type: 'vulnerable_dependency',
        severity: 'high',
        description: '📦 Outdated dependency with known vulnerabilities',
        recommendation: '⬆️ Update dependencies to latest secure versions'
      }
    ];
  }
  
  // 📊 Calculate overall security score
  private calculateSecurityScore(findings: SecurityFinding[]): number {
    const weights = { critical: 10, high: 5, medium: 2, low: 1 };
    const totalWeight = findings.reduce((sum, finding) => {
      return sum + weights[finding.severity];
    }, 0);
    
    // 📈 Score from 0-100 (100 = perfect security)
    return Math.max(0, 100 - totalWeight);
  }
}

interface SecurityFinding {
  type: string;
  severity: 'low' | 'medium' | 'high' | 'critical';
  description: string;
  recommendation: string;
}

interface SecurityScanResult {
  timestamp: Date;
  totalFindings: number;
  criticalFindings: number;
  findings: SecurityFinding[];
  overallScore: number;
}

🏗️ Advanced Topic 2: Security Testing CI/CD Integration

For the brave developers implementing DevSecOps:

// 🚀 CI/CD Security Integration
class DevSecOpsIntegration {
  
  // 🔄 Run security tests in CI/CD pipeline
  async runSecurityPipeline(): Promise<PipelineResult> {
    console.log("🚀 Starting DevSecOps security pipeline...");
    
    const steps: PipelineStep[] = [
      { name: "🔍 Static Analysis", status: 'pending' },
      { name: "🧪 Security Unit Tests", status: 'pending' },
      { name: "📦 Dependency Audit", status: 'pending' },
      { name: "🕷️ Dynamic Security Testing", status: 'pending' },
      { name: "🛡️ Container Security Scan", status: 'pending' }
    ];
    
    for (const step of steps) {
      step.status = 'running';
      console.log(`⏳ Running: ${step.name}`);
      
      // 🧪 Simulate security test execution
      await this.simulateSecurityTest();
      
      step.status = 'completed';
      console.log(`✅ Completed: ${step.name}`);
    }
    
    return {
      success: true,
      steps,
      securityScore: 95,
      recommendations: [
        "🔧 Update 2 dependencies with security patches",
        "🛡️ Add rate limiting to API endpoints",
        "🔐 Implement additional input validation"
      ]
    };
  }
  
  // ⏱️ Simulate security test
  private async simulateSecurityTest(): Promise<void> {
    return new Promise(resolve => setTimeout(resolve, 1000));
  }
}

interface PipelineStep {
  name: string;
  status: 'pending' | 'running' | 'completed' | 'failed';
}

interface PipelineResult {
  success: boolean;
  steps: PipelineStep[];
  securityScore: number;
  recommendations: string[];
}

⚠️ Common Security Pitfalls and Solutions

😱 Pitfall 1: Trusting User Input

// ❌ Wrong way - trusting user input!
function processUserData(userData: any): void {
  // 💥 Never do this - direct database query with user input!
  const query = `SELECT * FROM users WHERE id = ${userData.id}`;
  console.log("🚨 This is vulnerable to SQL injection!");
}

// ✅ Correct way - validate and sanitize!
function processUserDataSecurely(userData: unknown): void {
  // 🛡️ Type guard to ensure proper structure
  if (!isValidUserData(userData)) {
    throw new Error("⚠️ Invalid user data format");
  }
  
  // 🧹 Sanitize the input
  const validator = new SecureInputValidator();
  const validationResult = validator.validateSqlInput(userData.id.toString());
  
  if (!validationResult.isValid) {
    throw new Error("🚨 Security validation failed");
  }
  
  // ✅ Safe to process now
  console.log(`✨ Processing secure user data for ID: ${validationResult.sanitizedInput}`);
}

function isValidUserData(data: unknown): data is { id: number; name: string } {
  return typeof data === 'object' && 
         data !== null &&
         'id' in data && 
         'name' in data &&
         typeof (data as any).id === 'number';
}

🤯 Pitfall 2: Storing Sensitive Data Insecurely

// ❌ Dangerous - plaintext sensitive data!
interface UnsafeUser {
  id: string;
  email: string;
  password: string; // 💥 Never store passwords in plaintext!
  creditCard: string; // 💥 Never store unencrypted payment data!
}

// ✅ Safe - proper data protection!
interface SecureUserData {
  id: string;
  email: string;
  passwordHash: string; // 🔐 Hashed with salt
  encryptedPaymentToken?: string; // 🛡️ Encrypted or tokenized
  lastLoginAttempt?: Date;
  failedLoginAttempts: number;
}

class SecureUserManager {
  // ✅ Secure password handling
  async createUser(email: string, password: string): Promise<SecureUserData> {
    // 🧂 Hash password with salt (bcrypt recommended)
    const passwordHash = await this.secureHashPassword(password);
    
    return {
      id: this.generateSecureId(),
      email,
      passwordHash,
      failedLoginAttempts: 0
    };
  }
  
  // 🔐 Secure password verification
  async verifyPassword(user: SecureUserData, password: string): Promise<boolean> {
    // 🔍 Compare with hashed password
    return await this.compareHashedPassword(password, user.passwordHash);
  }
  
  private async secureHashPassword(password: string): Promise<string> {
    // 🛡️ In real implementation, use bcrypt.hash()
    return `secure_hash_${password}_with_salt_${Date.now()}`;
  }
  
  private async compareHashedPassword(password: string, hash: string): Promise<boolean> {
    // 🔍 In real implementation, use bcrypt.compare()
    return hash.includes(password); // Simplified for demo
  }
  
  private generateSecureId(): string {
    return `user_${Math.random().toString(36).substr(2, 16)}`;
  }
}

🛠️ Best Practices

  1. 🎯 Validate Everything: Never trust user input - validate and sanitize all data!
  2. 📝 Use Type Guards: TypeScript type guards help catch security issues at compile time
  3. 🛡️ Encrypt Sensitive Data: Always encrypt passwords, payment data, and personal information
  4. 🎨 Implement Rate Limiting: Prevent brute force attacks with proper throttling
  5. ✨ Keep Dependencies Updated: Regularly audit and update your npm packages
  6. 🔧 Use HTTPS Everywhere: Encrypt data in transit with TLS/SSL
  7. 🎯 Follow Principle of Least Privilege: Give users only the access they need
  8. 📊 Log Security Events: Monitor and log security-related activities

🧪 Hands-On Exercise

🎯 Challenge: Build a Secure API Authentication System

Create a comprehensive secure authentication system for a TypeScript API:

📋 Requirements:

  • ✅ User registration with strong password validation
  • 🔐 Secure login with JWT tokens and rate limiting
  • 🛡️ Session management with automatic timeout
  • 🚨 Brute force protection with account lockout
  • 📊 Security event logging
  • 🔍 Input validation and sanitization
  • 🎨 Each endpoint needs proper security headers!

🚀 Bonus Points:

  • Add two-factor authentication (2FA)
  • Implement OAuth integration
  • Create security audit dashboard
  • Add automated penetration testing

💡 Solution

🔍 Click to see solution
// 🎯 Our comprehensive secure authentication system!
interface SecureAuthUser {
  id: string;
  email: string;
  passwordHash: string;
  isEmailVerified: boolean;
  failedLoginAttempts: number;
  lastFailedLogin?: Date;
  accountLockedUntil?: Date;
  twoFactorSecret?: string;
  securityEvents: SecurityEvent[];
}

interface SecurityEvent {
  type: 'login' | 'logout' | 'failed_login' | 'password_change' | 'suspicious_activity';
  timestamp: Date;
  ipAddress: string;
  userAgent: string;
  success: boolean;
}

interface JWTPayload {
  userId: string;
  email: string;
  iat: number;
  exp: number;
}

class SecureAuthenticationSystem {
  private users: Map<string, SecureAuthUser> = new Map();
  private rateLimiter: Map<string, { attempts: number; resetTime: Date }> = new Map();
  private securityLogger: SecurityLogger;
  
  constructor() {
    this.securityLogger = new SecurityLogger();
  }
  
  // 📝 Secure user registration
  async registerUser(email: string, password: string, ipAddress: string): Promise<AuthResult> {
    try {
      // 🔍 Validate input
      const emailValidation = this.validateEmail(email);
      if (!emailValidation.isValid) {
        return { success: false, errors: emailValidation.errors };
      }
      
      const passwordValidation = this.validatePasswordStrength(password);
      if (!passwordValidation.isValid) {
        return { success: false, errors: passwordValidation.errors };
      }
      
      // 🔍 Check if user already exists
      const existingUser = Array.from(this.users.values()).find(u => u.email === email);
      if (existingUser) {
        return { success: false, errors: ["🚨 User already exists"] };
      }
      
      // 🔐 Create secure user
      const user: SecureAuthUser = {
        id: this.generateSecureId(),
        email: email.toLowerCase().trim(),
        passwordHash: await this.hashPassword(password),
        isEmailVerified: false,
        failedLoginAttempts: 0,
        securityEvents: []
      };
      
      this.users.set(user.id, user);
      
      // 📊 Log security event
      this.securityLogger.logEvent({
        type: 'registration',
        userId: user.id,
        ipAddress,
        timestamp: new Date(),
        success: true
      });
      
      console.log(`✅ User registered securely: ${user.email}`);
      return { success: true, userId: user.id };
      
    } catch (error) {
      console.error("🚨 Registration error:", error);
      return { success: false, errors: ["❌ Registration failed"] };
    }
  }
  
  // 🔐 Secure login with rate limiting
  async login(email: string, password: string, ipAddress: string, userAgent: string): Promise<AuthResult> {
    try {
      // 🚦 Check rate limiting
      if (!this.checkRateLimit(ipAddress)) {
        this.securityLogger.logEvent({
          type: 'rate_limit_exceeded',
          ipAddress,
          timestamp: new Date(),
          success: false
        });
        return { success: false, errors: ["⏰ Too many login attempts. Please try again later."] };
      }
      
      // 🔍 Find user
      const user = Array.from(this.users.values()).find(u => u.email === email.toLowerCase());
      
      if (!user) {
        this.incrementRateLimit(ipAddress);
        return { success: false, errors: ["❌ Invalid credentials"] };
      }
      
      // 🔒 Check if account is locked
      if (this.isAccountLocked(user)) {
        this.securityLogger.logEvent({
          type: 'login_attempt_locked_account',
          userId: user.id,
          ipAddress,
          timestamp: new Date(),
          success: false
        });
        return { success: false, errors: ["🔒 Account is temporarily locked due to suspicious activity"] };
      }
      
      // 🔍 Verify password
      const isPasswordValid = await this.verifyPassword(password, user.passwordHash);
      
      if (!isPasswordValid) {
        // 📈 Increment failed attempts
        user.failedLoginAttempts++;
        user.lastFailedLogin = new Date();
        
        // 🔒 Lock account after 5 failed attempts
        if (user.failedLoginAttempts >= 5) {
          user.accountLockedUntil = new Date(Date.now() + 30 * 60 * 1000); // 30 minutes
        }
        
        this.incrementRateLimit(ipAddress);
        
        this.securityLogger.logEvent({
          type: 'failed_login',
          userId: user.id,
          ipAddress,
          userAgent,
          timestamp: new Date(),
          success: false
        });
        
        return { success: false, errors: ["❌ Invalid credentials"] };
      }
      
      // ✅ Successful login - reset counters
      user.failedLoginAttempts = 0;
      delete user.accountLockedUntil;
      this.resetRateLimit(ipAddress);
      
      // 🎫 Generate JWT token
      const token = this.generateJWTToken(user);
      
      // 📊 Log successful login
      this.securityLogger.logEvent({
        type: 'successful_login',
        userId: user.id,
        ipAddress,
        userAgent,
        timestamp: new Date(),
        success: true
      });
      
      console.log(`✅ User logged in: ${user.email}`);
      return { success: true, token, userId: user.id };
      
    } catch (error) {
      console.error("🚨 Login error:", error);
      return { success: false, errors: ["❌ Login failed"] };
    }
  }
  
  // 🎫 Generate JWT token
  private generateJWTToken(user: SecureAuthUser): string {
    const payload: JWTPayload = {
      userId: user.id,
      email: user.email,
      iat: Math.floor(Date.now() / 1000),
      exp: Math.floor(Date.now() / 1000) + (60 * 60) // 1 hour expiry
    };
    
    // 🔐 In real implementation, use jsonwebtoken library
    return `jwt.${btoa(JSON.stringify(payload))}.signature`;
  }
  
  // 🔍 Verify JWT token
  verifyToken(token: string): { valid: boolean; payload?: JWTPayload } {
    try {
      // 🔍 Parse token (simplified for demo)
      const parts = token.split('.');
      if (parts.length !== 3) {
        return { valid: false };
      }
      
      const payload = JSON.parse(atob(parts[1])) as JWTPayload;
      
      // ⏰ Check expiry
      if (payload.exp < Math.floor(Date.now() / 1000)) {
        return { valid: false };
      }
      
      return { valid: true, payload };
    } catch {
      return { valid: false };
    }
  }
  
  // 🚦 Rate limiting implementation
  private checkRateLimit(ipAddress: string): boolean {
    const limit = this.rateLimiter.get(ipAddress);
    
    if (!limit) {
      return true;
    }
    
    if (new Date() > limit.resetTime) {
      this.rateLimiter.delete(ipAddress);
      return true;
    }
    
    return limit.attempts < 10; // Max 10 attempts per hour
  }
  
  private incrementRateLimit(ipAddress: string): void {
    const existing = this.rateLimiter.get(ipAddress);
    const resetTime = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
    
    if (existing) {
      existing.attempts++;
    } else {
      this.rateLimiter.set(ipAddress, { attempts: 1, resetTime });
    }
  }
  
  private resetRateLimit(ipAddress: string): void {
    this.rateLimiter.delete(ipAddress);
  }
  
  // 🔒 Check if account is locked
  private isAccountLocked(user: SecureAuthUser): boolean {
    if (!user.accountLockedUntil) {
      return false;
    }
    
    if (new Date() > user.accountLockedUntil) {
      delete user.accountLockedUntil; // Unlock account
      return false;
    }
    
    return true;
  }
  
  // 🔐 Password utilities
  private async hashPassword(password: string): Promise<string> {
    // 🛡️ In real implementation, use bcrypt
    return `hashed_${password}_${Date.now()}`;
  }
  
  private async verifyPassword(password: string, hash: string): Promise<boolean> {
    // 🔍 In real implementation, use bcrypt.compare
    return hash.includes(password);
  }
  
  // 🛡️ Validation utilities
  private validateEmail(email: string): ValidationResult {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
    return {
      isValid: emailRegex.test(email),
      errors: emailRegex.test(email) ? [] : ["📧 Invalid email format"]
    };
  }
  
  private validatePasswordStrength(password: string): ValidationResult {
    const errors: string[] = [];
    
    if (password.length < 8) errors.push("🔑 Password must be at least 8 characters");
    if (!/[A-Z]/.test(password)) errors.push("🔑 Password must contain uppercase letters");
    if (!/[a-z]/.test(password)) errors.push("🔑 Password must contain lowercase letters");
    if (!/[0-9]/.test(password)) errors.push("🔑 Password must contain numbers");
    if (!/[!@#$%^&*]/.test(password)) errors.push("🔑 Password must contain special characters");
    
    return { isValid: errors.length === 0, errors };
  }
  
  private generateSecureId(): string {
    return `user_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  }
}

// 📊 Security event logger
class SecurityLogger {
  private events: SecurityEvent[] = [];
  
  logEvent(event: Omit<SecurityEvent, 'timestamp'> & { timestamp: Date }): void {
    this.events.push(event as SecurityEvent);
    console.log(`🔍 Security Event: ${event.type} - ${event.success ? '✅' : '❌'}`);
  }
  
  getSecurityReport(): SecurityReport {
    const last24Hours = this.events.filter(e => 
      e.timestamp > new Date(Date.now() - 24 * 60 * 60 * 1000)
    );
    
    return {
      totalEvents: this.events.length,
      last24Hours: last24Hours.length,
      failedLogins: this.events.filter(e => e.type === 'failed_login').length,
      suspiciousActivity: this.events.filter(e => e.type === 'suspicious_activity').length
    };
  }
}

interface AuthResult {
  success: boolean;
  token?: string;
  userId?: string;
  errors?: string[];
}

interface SecurityReport {
  totalEvents: number;
  last24Hours: number;
  failedLogins: number;
  suspiciousActivity: number;
}

// 🎮 Test the secure authentication system!
const authSystem = new SecureAuthenticationSystem();

// 📝 Register a user
authSystem.registerUser("[email protected]", "SecurePass123!", "192.168.1.1");

// 🔐 Login
authSystem.login("[email protected]", "SecurePass123!", "192.168.1.1", "Mozilla/5.0...");

🎓 Key Takeaways

You’ve learned so much about OWASP security testing! Here’s what you can now do:

  • ✅ Implement OWASP principles with confidence 💪
  • ✅ Prevent common vulnerabilities like injection attacks 🛡️
  • ✅ Build secure authentication systems in real projects 🎯
  • ✅ Test for security issues like a pro 🐛
  • ✅ Create amazing secure applications with TypeScript! 🚀

Remember: Security is not a feature, it’s a foundation! It’s here to protect your users and your business. 🤝

🤝 Next Steps

Congratulations! 🎉 You’ve mastered OWASP security testing principles!

Here’s what to do next:

  1. 💻 Practice implementing the security testing patterns above
  2. 🏗️ Build a secure application using OWASP guidelines
  3. 📚 Move on to our next tutorial: Performance Testing & Load Testing
  4. 🌟 Share your security knowledge with other developers!

Remember: Every security expert was once a beginner. Keep coding securely, keep learning, and most importantly, protect your users! 🛡️

Happy secure coding! 🎉🚀✨

Previous Tutorial
🧪 Load Testing: Artillery and K6
Next Tutorial
🧪 Accessibility Testing: Testing for A11y

More typescript Tutorials

Part 227

🧪 Load Testing: Artillery and K6

🚀Intermediate • 30 min read
Part 228 - Currently Reading

🔒 Security Testing: OWASP Compliance

🚀Intermediate • 30 min read
Part 229

🧪 Accessibility Testing: Testing for A11y

🚀Intermediate • 30 min read
View all 355 typescript tutorials →

Tutorial Info

Series Progress
Part 228 of 355 64%
Category
📘 typescript
Difficulty
🚀Intermediate
Duration
30 min read
Published
June 24, 2025