보안 모범 사례

// ❌ 하드코딩 금지
const cb = new ConnectBase({ secretKey: 'cb_sk_actual_secret_key_here' })

// ✅ 환경 변수 사용
const cb = new ConnectBase({
    secretKey: process.env.CONNECT_BASE_SECRET_KEY
})

# .gitignore
.env
.env.local
.env.production
.env.*.local
*.pem
*.key

import { z } from 'zod'

const userSchema = z.object({
    login_id: z.string().min(3).max(30),
    password: z.string().min(8),
    nickname: z.string().min(1).max(50)
})

const validated = userSchema.parse(formData)
await cb.auth.signUpMember(validated)

// fn_user_action.js
export default async function handler(request, context) {
    const { user_id, action } = request.body

    if (typeof user_id !== 'string' || !user_id.startsWith('member_')) {
        return { error: 'invalid user_id', status: 400 }
    }

    if (!['like', 'unlike', 'report'].includes(action)) {
        return { error: 'invalid action', status: 400 }
    }

    // ... 검증된 입력으로 처리
}

// React 는 기본적으로 XSS 방지 (JSX 의 자동 escape)
// dangerouslySetInnerHTML 사용 시 DOMPurify 로 sanitize
import DOMPurify from 'dompurify'

const sanitized = DOMPurify.sanitize(userInput)
return <div dangerouslySetInnerHTML={{ __html: sanitized }} />

import { z } from 'zod'

const passwordSchema = z.string()
    .min(12, '최소 12자 이상')
    .regex(/[A-Z]/, '대문자 포함')
    .regex(/[a-z]/, '소문자 포함')
    .regex(/[0-9]/, '숫자 포함')
    .regex(/[^A-Za-z0-9]/, '특수문자 포함')

const cb = new ConnectBase({
    publicKey: 'cb_pk_...',

    // 토큰이 갱신될 때마다 호출 (localStorage 에 저장 등)
    onTokenRefresh: ({ accessToken, refreshToken }) => {
        localStorage.setItem('cb_access_token', accessToken)
        localStorage.setItem('cb_refresh_token', refreshToken)
    },

    // refresh_token 까지 만료된 경우 (재로그인 필요)
    onTokenExpired: () => {
        localStorage.removeItem('cb_access_token')
        localStorage.removeItem('cb_refresh_token')
        window.location.href = '/login'
    }
})

// Express 예시
app.use((req, res, next) => {
    if (req.header('x-forwarded-proto') !== 'https') {
        return res.redirect(`https://${req.header('host')}${req.url}`)
    }
    next()
})

// Content Security Policy
app.use((_, res, next) => {
    res.setHeader('Content-Security-Policy',
        "default-src 'self'; " +
        "script-src 'self' 'unsafe-inline'; " +
        "style-src 'self' 'unsafe-inline'; " +
        "img-src 'self' data: https://cdn.connectbase.world; " +
        "connect-src 'self' https://api.connectbase.world https://socket.connectbase.world"
    )
    next()
})

import helmet from 'helmet'
app.use(helmet())

function maskEmail(email: string): string {
    const [local, domain] = email.split('@')
    return local.slice(0, 2) + '***@' + domain
}

function maskPhone(phone: string): string {
    return phone.slice(0, 3) + '-****-' + phone.slice(-4)
}

const SENSITIVE_FIELDS = ['password', 'publicKey', 'secretKey', 'access_token', 'refresh_token', 'ssn', 'credit_card']

function sanitizeForLogging(data: Record<string, unknown>): Record<string, unknown> {
    const sanitized = { ...data }
    for (const field of SENSITIVE_FIELDS) {
        if (field in sanitized) {
            sanitized[field] = '[REDACTED]'
        }
    }
    return sanitized
}

console.log('Request:', sanitizeForLogging(requestData))

const cb = new ConnectBase({
    publicKey: 'cb_pk_...',
    errorTracker: {
        // 콘솔에서 발급한 트래커 설정
        enabled: true
    }
})