Configuration Security Vulnerability

User Story

As a security-conscious developer, I want to protect API configuration and sensitive endpoints from being exposed on the client side, so that unauthorized users cannot discover or exploit backend services.

Current Problem

// public/setup.json - publicly accessible { "imageApiUrl": "http://<YOUR_API_HOST>:/search" }

Issues Identified:

• Sensitive API endpoint publicly exposed.
• No API key or authentication mechanism implemented.
• Risk of CORS-based data extraction and unauthorized requests.
• Potential credential leaks if secrets are later added to this file.

Acceptance Criteria

• The /public/setup.json file is removed or replaced with environment-based configuration.
• Frontend retrieves the API endpoint securely via environment variables (e.g., process.env.NEXT_PUBLIC_API_URL).
• API requests are proxied through the backend or middleware to hide internal endpoints.
• Backend endpoints require API key or token-based authentication.
• CORS policy restricts origins to approved frontend domains only.
• Security check integrated into CI/CD to detect exposed config files before deployment.
• Confirmed via penetration testing or manual audit that no sensitive info is visible in the frontend build.

1. Proposed Implementation Steps

• Move Configuration Securely
• Delete public/setup.json.
• Store URLs in .env.local / .env.production files.
• Update frontend references to use process.env.

2. Proxy API Calls

• Add a server-side route (e.g., /api/search) that forwards requests to the backend.

3. Add API Key Verification

• Implement token or key-based access control in the backend.

4. Restrict CORS

• Configure CORS to only allow trusted frontend domains.

5. Add CI/CD Security Validation

• Use a GitHub Action or linter to block commits exposing files in /public.