Trust Boundaries: Everything the Client Sends Is Hostile

// ❌ The client tells you what it costs
app.post('/api/orders', auth, async (req, res) => {
  const { items, total } = req.body;
  await charge(req.user.id, total);              // {"total": 0.01}
  await db.orders.create({ userId: req.user.id, items, total });
  res.status(201).json({ ok: true });
});

// ✅ The client tells you WHAT. The server decides HOW MUCH.
const orderSchema = z.object({
  items: z.array(z.object({
    productId: z.string().uuid(),
    quantity: z.number().int().min(1).max(100),
  })).min(1).max(50),
  couponCode: z.string().max(32).optional(),
  // NOTE: no price, no total, no discount, no currency. Not accepted.
}).strict();

app.post('/api/orders', auth, validate(orderSchema), async (req, res) => {
  const products = await db.products.findMany(req.body.items.map((i) => i.productId));
  if (products.length !== req.body.items.length) {
    return res.status(400).json({ error: 'unknown_product' });
  }

  // Every number comes from OUR database.
  let subtotal = 0;
  for (const line of req.body.items) {
    const product = products.find((p) => p.id === line.productId);
    if (!product.active) return res.status(409).json({ error: 'product_unavailable' });
    if (product.stock < line.quantity) return res.status(409).json({ error: 'insufficient_stock' });
    subtotal += product.priceCents * line.quantity;
  }

  // Coupons are validated, not applied as sent.
  const discount = req.body.couponCode
    ? await computeDiscount(req.body.couponCode, req.user.id, subtotal)
    : 0;

  const total = subtotal - discount + computeTax(subtotal - discount, req.user);

  await charge(req.user.id, total);
  res.status(201).json({ orderId: await createOrder(req.user.id, req.body.items, total) });
});

// The general rule: the client sends IDENTIFIERS and QUANTITIES.
// Everything derived — prices, totals, discounts, permissions, timestamps —
// is computed server-side from data the client cannot reach.

// A header is trustworthy only if a component you trust set it AND the client
// cannot reach your service without passing through that component.

// ── X-Forwarded-For: only with configured trusted proxies ─────────────
app.set('trust proxy', 1);        // exactly the number of hops you run
// ⚠️ never `true` on a publicly reachable app: the client prepends whatever it
//    likes and gets a fresh rate-limit bucket per request.

// ── Host: never trust for URL generation ──────────────────────────────
const APP_URL = process.env.APP_URL;    // configuration, not a header
if (!APP_URL) throw new Error('APP_URL must be set');
const resetLink = `${APP_URL}/reset?token=${token}`;

// And reject unexpected hosts at the edge as a second layer:
const ALLOWED_HOSTS = new Set(['abc.com', 'www.abc.com']);
app.use((req, res, next) =>
  ALLOWED_HOSTS.has(req.hostname) ? next() : res.status(400).send('Bad Host'));

// ── Origin vs Referer for CSRF ────────────────────────────────────────
function originIsAllowed(req) {
  const origin = req.get('origin');
  // Origin is set by the browser and page scripts cannot forge it.
  if (origin) return ALLOWED_ORIGINS.has(origin);

  // ❌ if (!origin) return true;   ← the bypass: just omit the header
  // Referer is stripped by privacy settings, proxies and Referrer-Policy,
  // so it is a weak fallback and must never be the only check.
  return false;                     // no Origin on a mutating request → refuse
}

// ── Identity headers: strip, then set ─────────────────────────────────
app.use((req, res, next) => {
  for (const name of Object.keys(req.headers)) {
    if (/^x-(internal|user|tenant|role)-?/i.test(name)) delete req.headers[name];
  }
  next();
});
// ...and downstream services verify a SIGNATURE rather than reading a header,
// so a missed strip is not a bypass.

// ── Content-Type: never trust it for a security decision ──────────────
// An upload claiming image/png can be anything. Sniff the magic bytes.

// OWASP API10. A vendor being compromised, or simply changing their schema,
// should not become a vulnerability in your service.
import { z } from 'zod';

const partnerSchema = z.object({
  id: z.string().max(64),
  displayName: z.string().max(200),
  status: z.enum(['active', 'suspended', 'closed']),
  balanceCents: z.number().int().min(0).max(1_000_000_000),
  metadata: z.record(z.string().max(500)).optional(),
}).strict();

export async function fetchPartnerAccount(accountId) {
  const res = await fetch(`https://partner.example.com/accounts/${accountId}`, {
    headers: { Authorization: `Bearer ${PARTNER_TOKEN}` },
    signal: AbortSignal.timeout(5000),           // never hang on someone else
    redirect: 'error',                           // a 302 could point anywhere
  });
  if (!res.ok) throw new UpstreamError(res.status);

  // Bound the size BEFORE parsing — a compromised partner can send 10GB.
  const length = Number(res.headers.get('content-length') ?? 0);
  if (length > 1_000_000) throw new UpstreamError('response_too_large');

  const raw = await res.json();

  // Validate as strictly as you would validate a browser request.
  const parsed = partnerSchema.safeParse(raw);
  if (!parsed.success) {
    logger.error({ issues: parsed.error.issues }, 'partner response failed validation');
    throw new UpstreamError('invalid_upstream_response');
  }

  return parsed.data;
}

// And downstream, treat the values as untrusted content:
//   ❌ element.innerHTML = account.displayName        → stored XSS via a partner
//   ✅ element.textContent = account.displayName
//   ❌ db.raw(`... WHERE ref = '${account.id}'`)      → injection via a partner
//   ✅ db('x').where({ ref: account.id })

// redirect: 'error' is the subtle one — following a redirect from a partner
// turns their compromise into an SSRF in your network.