15 lines
874 B
Markdown
15 lines
874 B
Markdown
# 🔒 Security & Performance Review (09_devops_security)
|
|
|
|
## Security Architecture & Best Practices
|
|
1. **API Security & Auth Guards**:
|
|
- NestJS JWT strategy validation with expiration and payload checking.
|
|
- Strict `RolesGuard` protecting B2B wholesale routes (`User_Wholesale`) and Admin routes (`ADMIN`).
|
|
- Rate limiting via NestJS `@nestjs/throttler` to prevent abuse.
|
|
- CORS policy allowing configured origins only.
|
|
2. **Data Sanitization & Injection Prevention**:
|
|
- NestJS global `ValidationPipe` preventing mass assignment and SQL injection via Prisma parameterized queries.
|
|
- Password hashing using bcrypt.
|
|
3. **Performance & Caching**:
|
|
- PostgreSQL indexing on frequent search fields (`categorySlug`, `suitableFor`, `artNo`, `slug`, `requiresRx`).
|
|
- Next.js caching strategy (`revalidate` / fetch caching) for high-frequency dynamic routes.
|