Panduan Lengkap Website Security dari Cross-Site Scripting hingga SQL Injection Prevention Tahun 2026

// Secure Role-Based Access Control (RBAC) Implementation
class SecureAccessControl {
    constructor() {
        this.roles = {
            admin: ['read', 'write', 'delete', 'manage_users'],
            moderator: ['read', 'write', 'moderate'],
            user: ['read', 'write_own'],
            guest: ['read_public']
        };

        this.permissions = {
            'user:create': ['admin', 'moderator'],
            'user:update': ['admin', 'moderator', 'user'],
            'user:delete': ['admin'],
            'content:create': ['admin', 'moderator', 'user'],
            'content:update': ['admin', 'moderator'],
            'content:delete': ['admin', 'moderator'],
            'content:moderate': ['admin', 'moderator']
        };
    }

    async checkPermission(userId, resource, action) {
        try {
            // Get user role and verify it's active
            const user = await this.getUser(userId);
            if (!user || !user.active) {
                throw new Error('User not found or inactive');
            }

            // Check if user has required permission
            const requiredPermission = `${resource}:${action}`;
            const hasPermission = this.permissions[requiredPermission]?.includes(user.role);

            if (!hasPermission) {
                // Log unauthorized access attempt
                await this.logSecurityEvent({
                    type: 'UNAUTHORIZED_ACCESS',
                    userId,
                    resource,
                    action,
                    timestamp: new Date(),
                    ip: this.getClientIP(),
                    userAgent: this.getClientUserAgent()
                });

                return false;
            }

            // Additional context-based checks
            return await this.performContextualChecks(user, resource, action);

        } catch (error) {
            console.error('Permission check failed:', error);
            return false;
        }
    }

    async performContextualChecks(user, resource, action) {
        // Time-based restrictions
        if (this.isRestrictedTime(user.role)) {
            await this.logSecurityEvent({
                type: 'TIME_RESTRICTION_VIOLATION',
                userId: user.id,
                timestamp: new Date()
            });
            return false;
        }

        // Location-based restrictions
        const userLocation = await this.getUserLocation(user.id);
        if (this.isRestrictedLocation(userLocation, user.role)) {
            await this.logSecurityEvent({
                type: 'GEO_RESTRICTION_VIOLATION',
                userId: user.id,
                location: userLocation,
                timestamp: new Date()
            });
            return false;
        }

        // Resource ownership checks for non-admin users
        if (user.role !== 'admin' && action === 'update') {
            const resourceOwner = await this.getResourceOwner(resource);
            if (resourceOwner !== user.id) {
                return false;
            }
        }

        return true;
    }

    // Middleware implementation for Express.js
    requirePermission(resource, action) {
        return async (req, res, next) => {
            try {
                const userId = req.user?.id;
                if (!userId) {
                    return res.status(401).json({ error: 'Authentication required' });
                }

                const hasPermission = await this.checkPermission(userId, resource, action);
                if (!hasPermission) {
                    return res.status(403).json({ error: 'Insufficient permissions' });
                }

                next();
            } catch (error) {
                res.status(500).json({ error: 'Permission check failed' });
            }
        };
    }
}

// Usage in Express application
const accessControl = new SecureAccessControl();

app.post('/api/users',
    authenticate,
    accessControl.requirePermission('user', 'create'),
    userController.createUser
);

app.put('/api/content/:id',
    authenticate,
    accessControl.requirePermission('content', 'update'),
    contentController.updateContent
);

class SecureCrypto {
    constructor() {
        this.algorithm = {
            symmetric: 'aes-256-gcm',
            asymmetric: 'rsa-oaep-256',
            hash: 'sha-512'
        };

        this.keyDerivation = {
            algorithm: 'pbkdf2',
            iterations: 600000,
            hash: 'sha-256',
            saltLength: 32
        };
    }

    // Secure password hashing with pepper
    async securePasswordHash(password, pepper) {
        try {
            // Generate unique salt per user
            const salt = crypto.randomBytes(32);

            // Combine password with server-side pepper
            const pepperedPassword = Buffer.concat([
                Buffer.from(password, 'utf8'),
                Buffer.from(pepper, 'utf8')
            ]);

            // Derive key using PBKDF2
            const key = crypto.pbkdf2Sync(
                pepperedPassword,
                salt,
                this.keyDerivation.iterations,
                64,
                this.keyDerivation.hash
            );

            // Store salt and derived key
            return {
                hash: key.toString('hex'),
                salt: salt.toString('hex'),
                iterations: this.keyDerivation.iterations,
                algorithm: this.keyDerivation.hash
            };
        } catch (error) {
            throw new Error('Password hashing failed');
        }
    }

    // Secure symmetric encryption for sensitive data
    async encryptSymmetric(plaintext, key) {
        try {
            const iv = crypto.randomBytes(16);
            const cipher = crypto.createCipher(this.algorithm.symmetric, key);
            cipher.setAAD(Buffer.from('additional-data'));

            let encrypted = cipher.update(plaintext, 'utf8', 'hex');
            encrypted += cipher.final('hex');

            const authTag = cipher.getAuthTag();

            return {
                encryptedData: encrypted,
                iv: iv.toString('hex'),
                authTag: authTag.toString('hex'),
                algorithm: this.algorithm.symmetric
            };
        } catch (error) {
            throw new Error('Encryption failed');
        }
    }

    // Secure key generation
    generateSecureKeyPair() {
        try {
            const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
                modulusLength: 4096,
                publicKeyEncoding: {
                    type: 'spki',
                    format: 'pem'
                },
                privateKeyEncoding: {
                    type: 'pkcs8',
                    format: 'pem',
                    cipher: 'aes-256-cbc',
                    passphrase: process.env.PRIVATE_KEY_PASSPHRASE
                }
            });

            return { publicKey, privateKey };
        } catch (error) {
            throw new Error('Key generation failed');
        }
    }

    // Token generation with JWT
    generateSecureToken(payload, expiresIn = '1h') {
        try {
            const header = {
                alg: 'HS256',
                typ: 'JWT',
                kid: process.env.KEY_ID
            };

            const tokenPayload = {
                ...payload,
                iat: Math.floor(Date.now() / 1000),
                exp: Math.floor(Date.now() / 1000) + this.parseExpiration(expiresIn),
                iss: process.env.ISSUER,
                aud: process.env.AUDIENCE
            };

            return jwt.sign(tokenPayload, process.env.JWT_SECRET, {
                algorithm: 'HS256',
                header: header
            });
        } catch (error) {
            throw new Error('Token generation failed');
        }
    }

    parseExpiration(expiresIn) {
        const timeUnits = {
            's': 1,
            'm': 60,
            'h': 3600,
            'd': 86400,
            'w': 604800
        };

        const match = expiresIn.match(/^(\d+)([smhdw])$/);
        if (!match) {
            throw new Error('Invalid expiration format');
        }

        const [, amount, unit] = match;
        return parseInt(amount) * timeUnits[unit];
    }
}

class InjectionProtection {
    constructor() {
        this.blacklistPatterns = [
            /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|UNION)\b)/i,
            /(\b(OR|AND)\s+\d+\s*=\s*\d+)/i,
            /(\b(OR|AND)\s+['"][^'"]*['"]\s*=\s*['"][^'"]*['"])/i,
            /(\b(OR|AND)\s+['"][^'"]*['"]\s*LIKE\s*['"][^'"]*['"])/i,
            /(\b(WAITFOR|DELAY)\s+\d+)/i,
            /(\b(SLEEP|BENCHMARK)\s*\()/i,
            /(\b(CONCAT|CHAR|ASCII|ORD)\s*\()/i,
            /(\b(XOR|NOT|IN|EXISTS)\s)/i,
            /(--|#|\/\*|\*\/)/,
            /(\b(CASE|WHEN|THEN|END|IF)\s)/i,
            /(\b(CAST|CONVERT)\s*\()/i
        ];

        this.noSQLPatterns = [
            /\$where/gi,
            /\$ne/gi,
            /\$gt/gi,
            /\$lt/gi,
            /\$in/gi,
            /\$nin/gi,
            /\$regex/gi,
            /\$expr/gi,
            /\$jsonSchema/gi
        ];
    }

    // SQL Injection Prevention
    sanitizeSQLInput(input) {
        if (typeof input === 'string') {
            // Check against blacklist patterns
            for (const pattern of this.blacklistPatterns) {
                if (pattern.test(input)) {
                    throw new Error('Potential SQL injection detected');
                }
            }

            // Remove potential escape sequences
            return input
                .replace(/\\/, '\\\\')
                .replace(/'/, "\\'")
                .replace(/"/, '\\"')
                .replace(/\x00/, '\\0')
                .replace(/\n/, '\\n')
                .replace(/\r/, '\\r');
        }

        return input;
    }

    // Parameterized Query Builder
    buildParameterizedQuery(baseQuery, parameters) {
        try {
            // Validate base query structure
            if (this.containsSQLKeywords(baseQuery)) {
                throw new Error('Invalid query structure');
            }

            const queryParams = [];
            let processedQuery = baseQuery;

            // Replace named parameters with placeholders
            processedQuery = processedQuery.replace(/:([a-zA-Z_]\w*)/g, (match, paramName) => {
                if (paramName in parameters) {
                    queryParams.push(parameters[paramName]);
                    return '$' + queryParams.length;
                }
                throw new Error(`Parameter ${paramName} not found`);
            });

            return {
                query: processedQuery,
                parameters: queryParams,
                isValid: true
            };
        } catch (error) {
            throw new Error(`Query building failed: ${error.message}`);
        }
    }

    // NoSQL Injection Prevention
    sanitizeNoSQLInput(input) {
        if (typeof input === 'object' && input !== null) {
            const sanitized = {};

            for (const [key, value] of Object.entries(input)) {
                // Check for dangerous MongoDB operators
                if (this.noSQLPatterns.some(pattern => pattern.test(key))) {
                    throw new Error(`NoSQL injection detected in field: ${key}`);
                }

                sanitized[key] = this.sanitizeNoSQLInput(value);
            }

            return sanitized;
        }

        if (typeof input === 'string') {
            // Check for NoSQL injection patterns
            for (const pattern of this.noSQLPatterns) {
                if (pattern.test(input)) {
                    throw new Error('NoSQL injection detected in input');
                }
            }
        }

        return input;
    }

    // Input validation middleware
    validateInput(req, res, next) {
        try {
            // Validate query parameters
            for (const [key, value] of Object.entries(req.query)) {
                req.query[key] = this.sanitizeSQLInput(value);
            }

            // Validate request body
            if (req.body) {
                req.body = this.sanitizeNoSQLInput(req.body);
            }

            // Validate URL parameters
            for (const [key, value] of Object.entries(req.params)) {
                req.params[key] = this.sanitizeSQLInput(value);
            }

            next();
        } catch (error) {
            res.status(400).json({
                error: 'Invalid input detected',
                message: 'Your input contains potentially harmful content'
            });
        }
    }
}

// Secure Database Query Implementation
class SecureQueryBuilder {
    constructor(connection) {
        this.db = connection;
        this.injectionProtection = new InjectionProtection();
    }

    async secureQuery(query, parameters = {}) {
        try {
            const { query: processedQuery, parameters: queryParams } =
                this.injectionProtection.buildParameterizedQuery(query, parameters);

            const result = await this.db.query(processedQuery, queryParams);

            // Log query for audit purposes
            await this.logQuery(processedQuery, queryParams);

            return result;
        } catch (error) {
            await this.logError(query, parameters, error);
            throw new Error('Database query failed');
        }
    }

    async secureMongoQuery(collection, query, options = {}) {
        try {
            const sanitizedQuery = this.injectionProtection.sanitizeNoSQLInput(query);
            const sanitizedOptions = this.injectionProtection.sanitizeNoSQLInput(options);

            const result = await this.db.collection(collection).find(sanitizedQuery, sanitizedOptions).toArray();

            // Log query for audit
            await this.logMongoQuery(collection, sanitizedQuery, sanitizedOptions);

            return result;
        } catch (error) {
            await this.logError(collection, query, error);
            throw new Error('MongoDB query failed');
        }
    }
}

// Express.js Security Middleware
class SecurityHeaders {
    constructor() {
        this.cspPolicy = {
            'default-src': ["'self'"],
            'script-src': ["'self'", "'unsafe-inline'", "https://trusted-cdn.com"],
            'style-src': ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
            'img-src': ["'self'", "data:", "https:", "blob:"],
            'font-src': ["'self'", "https://fonts.gstatic.com"],
            'connect-src': ["'self'", "https://api.example.com"],
            'frame-ancestors': ["'none'"],
            'base-uri': ["'self'"],
            'form-action': ["'self'"],
            'upgrade-insecure-requests': []
        };

        this.permissionsPolicy = {
            'geolocation': [],
            'microphone': [],
            'camera': [],
            'payment': [],
            'usb': [],
            'magnetometer': [],
            'gyroscope': [],
            'accelerometer': [],
            'ambient-light-sensor': []
        };
    }

    // Content Security Policy Header
    getCSPHeader() {
        const cspDirectives = Object.entries(this.cspPolicy)
            .map(([directive, sources]) => {
                const sourceList = sources.length > 0 ? ' ' + sources.join(' ') : '';
                return directive + sourceList;
            })
            .join('; ');

        return {
            name: 'Content-Security-Policy',
            value: cspDirectives + '; report-uri /csp-violation-report'
        };
    }

    // Permissions Policy Header
    getPermissionsPolicyHeader() {
        const permissionsDirectives = Object.entries(this.permissionsPolicy)
            .map(([feature, allowList]) => {
                const allowed = allowList.length > 0 ? '=(' + allowList.join(' ') + ')' : '=(none)';
                return feature + allowed;
            })
            .join(', ');

        return {
            name: 'Permissions-Policy',
            value: permissionsDirectives
        };
    }

    // Complete security headers middleware
    securityHeaders() {
        return (req, res, next) => {
            // Content Security Policy
            res.setHeader(this.getCSPHeader().name, this.getCSPHeader().value);

            // Permissions Policy
            res.setHeader(this.getPermissionsPolicyHeader().name, this.getPermissionsPolicyHeader().value);

            // HSTS (Strict-Transport-Security)
            res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');

            // X-Frame-Options
            res.setHeader('X-Frame-Options', 'DENY');

            // X-Content-Type-Options
            res.setHeader('X-Content-Type-Options', 'nosniff');

            // X-XSS-Protection
            res.setHeader('X-XSS-Protection', '1; mode=block');

            // Referrer Policy
            res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');

            // Feature Policy
            res.setHeader('Feature-Policy', 'geography=(), microphone=(), camera=()');

            // Clear Site Data on logout
            if (req.path === '/logout') {
                res.setHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
            }

            next();
        };
    }
}

// Application security monitoring
class SecurityMonitor {
    constructor() {
        this.threatLevels = {
            LOW: 1,
            MEDIUM: 2,
            HIGH: 3,
            CRITICAL: 4
        };

        this.alertThresholds = {
            failedLogins: 5,
            sqlInjectionAttempts: 1,
            xssAttempts: 1,
            bruteForceAttempts: 10,
            unusualTraffic: 3.0
        };
    }

    async logSecurityEvent(event) {
        try {
            const securityEvent = {
                timestamp: new Date().toISOString(),
                type: event.type,
                severity: event.severity || 'MEDIUM',
                userId: event.userId,
                ip: event.ip,
                userAgent: event.userAgent,
                details: event.details,
                resolved: false
            };

            // Store in secure log
            await this.saveSecurityEvent(securityEvent);

            // Check if immediate action needed
            if (this.needsImmediateAction(securityEvent)) {
                await this.takeImmediateAction(securityEvent);
            }

            // Send notification if needed
            if (this.requiresNotification(securityEvent)) {
                await this.sendSecurityAlert(securityEvent);
            }

        } catch (error) {
            console.error('Failed to log security event:', error);
        }
    }

    needsImmediateAction(event) {
        return event.severity === 'CRITICAL' ||
               event.type === 'SQL_INJECTION' ||
               event.type === 'XSS_ATTACK';
    }

    async takeImmediateAction(event) {
        // Block IP temporarily
        await this.blockIP(event.ip, 3600); // 1 hour

        // Force logout user if logged in
        if (event.userId) {
            await this.forceLogout(event.userId);
        }

        // Notify security team
        await this.notifySecurityTeam(event, 'URGENT');
    }

    async analyzeThreatPatterns(timeWindow = 3600) {
        const events = await this.getRecentEvents(timeWindow);

        const analysis = {
            attackPatterns: this.identifyAttackPatterns(events),
            threatActors: this.identifyThreatActors(events),
            riskScore: this.calculateRiskScore(events),
            recommendations: this.generateSecurityRecommendations(events)
        };

        return analysis;
    }
}