undefined

def test_rejects_weak_password(self):
    """Password must meet minimum requirements"""
    auth = SecureAuth()
    with pytest.raises(ValueError, match="at least 12 characters"):
        auth.hash_password("short")

def test_password_hash_uses_argon2(self):
    """Must use Argon2id algorithm"""
    auth = SecureAuth()
    hashed = auth.hash_password("SecurePassword123!")
    assert hashed.startswith("$argon2id$")

def test_different_salts_per_hash(self):
    """Each hash must have unique salt"""
    auth = SecureAuth()
    hash1 = auth.hash_password("TestPassword123!")
    hash2 = auth.hash_password("TestPassword123!")
    assert hash1 != hash2

def test_rejects_sql_injection_in_email(self):
    """Must reject SQL injection attempts"""
    assert not InputValidator.validate_email("admin'--@test.com")

def test_rejects_xss_in_username(self):
    """Must reject XSS payloads"""
    assert not InputValidator.validate_username("<script>alert(1)</script>")

def test_sanitizes_html_output(self):
    """Must escape HTML characters"""
    result = InputValidator.sanitize_html("<script>alert(1)</script>")
    assert "<script>" not in result
    assert "&lt;script&gt;" in result

undefined

undefined

def hash_password(self, password: str) -> str:
    if len(password) < 12:
        raise ValueError("Password must be at least 12 characters")
    return self.ph.hash(password)

undefined

undefined

---

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

undefined

---

undefined

@staticmethod
def validate_email(email: str) -> bool:
    """Validate email using strict regex"""
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return bool(re.match(pattern, email)) and len(email) <= 254

@staticmethod
def validate_username(username: str) -> bool:
    """Validate username - alphanumeric only, 3-20 chars"""
    pattern = r'^[a-zA-Z0-9_]{3,20}$'
    return bool(re.match(pattern, username))

@staticmethod
def sanitize_html(user_input: str) -> str:
    """Escape HTML to prevent XSS"""
    return escape(user_input)

@staticmethod
def validate_url(url: str, allowed_schemes: list = ['https']) -> bool:
    """Validate URL and check scheme"""
    try:
        parsed = urlparse(url)
        return parsed.scheme in allowed_schemes and bool(parsed.netloc)
    except Exception:
        return False

@staticmethod
def validate_integer(value: str, min_val: int = None, max_val: int = None) -> Optional[int]:
    """Safely parse and validate integer"""
    try:
        num = int(value)
        if min_val is not None and num < min_val:
            return None
        if max_val is not None and num > max_val:
            return None
        return num
    except (ValueError, TypeError):
        return None

---

undefined

---

// ❌ DANGEROUS: Direct HTML insertion
element.innerHTML = 'Hello ' + name;  // Vulnerable to XSS

// ✅ SECURE: Use textContent (no HTML parsing)
element.textContent = 'Hello ' + name;

// ✅ SECURE: DOMPurify for rich HTML
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(html, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p'],
  ALLOWED_ATTR: ['href']
});

// ✅ SECURE: React/Vue automatically escape {variables}

undefined

def hash_password(self, password: str) -> str:
    if len(password) < 12:
        raise ValueError("Password must be at least 12 characters")
    return self.ph.hash(password)

def verify_password(self, password: str, hash: str) -> bool:
    try:
        self.ph.verify(hash, password)
        return True
    except VerifyMismatchError:
        return False

def generate_secure_token(self, bytes_length: int = 32) -> str:
    return secrets.token_urlsafe(bytes_length)

---

undefined

def create_access_token(self, user_id: int, roles: list) -> str:
    now = datetime.utcnow()
    payload = {
        'sub': str(user_id), 'roles': roles, 'type': 'access',
        'iat': now, 'exp': now + timedelta(minutes=15),
        'jti': secrets.token_hex(16)
    }
    return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)

def verify_token(self, token: str, expected_type: str = 'access'):
    try:
        payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm],
            options={'verify_exp': True, 'require': ['sub', 'exp', 'type', 'jti']})
        if payload.get('type') != expected_type:
            return None
        return payload
    except jwt.InvalidTokenError:
        return None

**📚 For advanced patterns** (Security Headers, Secrets Management with Vault, CI/CD Security Integration):
- See `references/implementation-patterns.md`

---