/secure-twitter

Secuirty Course - Semester 10

Primary LanguageJavaScript

Secure Twitter

How To Run

  • npm i --verbose
  • npm start
  • install insomnia and import final_api_docs.json

Demo

  • install insomnia/postman
  • import api_requests.json file
  • simulate any request needed

Features

Users

  • Follow/request ✔️
  • Unfollow ✔️
  • List (pagination) ✔️
  • Accept/Remove Follow Requests ✔️
  • My following/follower ✔️

Messages

  • List Chats ✔️
  • Send messages ✔️
  • List messages ✔️

Auth

  • Login ✔️
  • Register ✔️
  • Logout (invalidate token) ✔️
  • Refresh token ✔️

Tweets

  • Create ✔️
  • List User tweets ✔️
  • Favorite ✔️
  • Retweet ✔️
  • Trending ✔️

Messages

  • Send Messages (request) ✔️
  • List messages with user ✔️
  • List user chats (unique messages) ✔️

Authentication

  • Using JWT
  • Invalidate tokens after logout
  • Check for expired tokens

Authorization

  • Checking for roles

General Notes

  • limiting requets (prevent DOS)
  • handling any error (prevent crashes)
  • using regex in url params to add restrictions
  • Mongoose ORM has sanitizing guards
  • omitting user password when converted to JSON
  • sanitize tweets
  • add loggers
  • mongoose uri env var
  • using SSL