security/fix: comprehensive app hardening, restore OAuth login, and normalize note tags - #137
Open
jakharmonika364 wants to merge 10 commits into
Open
Conversation
… bundle - Added JS/config.js to .gitignore (root-level file was not protected) - Removed GROQ_API_KEY from the config object written to client/JS/config.js by server.js on startup — the key must never reach the browser - API key will only be consumed server-side via the upcoming AI proxy route (C1, C2, C4)
- Created server/routes/ai.js: authenticated POST /api/ai/generate endpoint that reads GROQ_API_KEY from process.env and proxies to Groq API - Mounted /api/ai route in server.js - Rewrote client/JS/geminiAPI.js to call /api/ai/generate instead of contacting Groq directly — the API key never reaches the browser - Proxy enforces: authentication check, prompt validation (non-empty, max 10k chars), graceful error handling without leaking internals
…ession (H4, H5, M3, M4)
…comments (L1, L3, L4, M2)
…okie Two bugs introduced by the security hardening commit: 1. SameSite: 'strict' broke OAuth login. When Google/GitHub redirects back to /api/auth/.../callback the browser treats it as a cross-site navigation and refuses to send a SameSite:strict cookie. Passport then cannot find the stored OAuth state in the session, causing the callback to fail silently. Fix: reverted to SameSite: 'lax' which allows OAuth GET redirects while still blocking cross-site POST/PUT/DELETE requests (CSRF for state changes). 2. Middleware registered out of order. Rate limiters and CSRF middleware were registered before express.json() and the session middleware, meaning they could not read request bodies or session data. Reordered to: body parsers -> CORS -> session/passport -> rate limit -> CSRF -> routes.
|
@jakharmonika364 is attempting to deploy a commit to the kunal628-hue's projects Team on Vercel. A member of the Team first needs to authorize it. |
- Remove import config from './config.js' from studentHub.js and
codeWorkspace.js; config.js was deleted in the security PR since the
GROQ_API_KEY moved to the server .env
- Update checkAPIKey() in both files to probe the server-side
/api/ai/generate proxy instead of reading a non-existent client key;
401/429 responses are treated as 'AI available' (just needs login)
- Fix geminiAPI.js to throw real Error objects on all failure paths
(401, non-ok, empty response) instead of returning '[AI Assistant]: ...'
strings that silently bypassed JSON parsing and caused the
'Unable to parse AI response as JSON' toast error
- Remove the now-dead aiResponse.includes('Error:') string checks in
studentHub.js (all three call sites) since errors are thrown properly
Ayush-Patel-56
approved these changes
Jun 12, 2026
Ayush-Patel-56
left a comment
Ayush-Patel-56
left a comment
Collaborator
There was a problem hiding this comment.
Looks Good to me. @Kunal317-singhi I tried it locally and every features is working. Also I can't found any lag issue in the app.
You also tried it locally once or approve the vercel deployment for better results.
From my end, we are good to go with this PR, as It solves mostly all the vulnurabilities and bugs.
Thanks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses all 19 security vulnerabilities identified in the workspace audit, fixes OAuth login, and resolves client-side rendering crashes caused by invalid data formats.
Key changes include:
Credentials & Key Protection: Deleted the exposed
client/JS/config.jscontaining API secrets, added it to.gitignore, and built a server-side AI proxy at/api/ai/generateto keep the Groq API key hidden.Backend Hardening:
express-validator) for write routes./api/auth/userendpoint to strip database identifiers and provider-specific details.Frontend XSS Protection: Integrated DOMPurify into HTML rendering and AI-generated outputs, utilizing a validated SRI hash in
app.htmlto guarantee script integrity.Login & Middleware Fixes: Restored OAuth functionality by switching session cookies to
SameSite: lax(allowing redirects) and fixing the execution order of body-parsers, CORS, and authentication middleware.Data Resiliency: Normalized the note tags field to always fall back to a clean array of strings, resolving client-side
note.tags.map is not a functionconsole errors when reading legacy databases.Type of Change
Checklist