spb/ultra-sharp-agent-skills Public

1---2name: securing-backend-services3description: Hardens backend services against common attacks — security headers, TLS, secret management, dependency scanning, SSRF and CSRF defenses, and safe error responses. Use when the user asks to secure a service or API, add security headers or CSP, manage secrets, run a security review of a backend, fix an SSRF/CSRF finding, or prepare for a pentest. Do not use for login flows (implementing-authentication), permission models (implementing-authorization), request schemas (validating-input), or database security (securing-databases).4---56<!--7Author: Simon-Pierre Boucher8Contact: contact@spboucher.ai9-->1011# Securing Backend Services1213## When to use / when NOT to use14- **Use for:** OWASP-aligned service hardening — headers, TLS, secrets, dependencies, SSRF/CSRF, error hygiene, service-account privilege.15- **Do NOT use for:** authentication flows, authorization models, input schemas, or database roles/encryption — each has its own skill. This skill is the layer around them.1617## Core rules18191. **Security headers on every response:**20   `Strict-Transport-Security: max-age=31536000; includeSubDomains`, `X-Content-Type-Options: nosniff`, `Content-Security-Policy` (start `default-src 'self'`), `frame-ancestors 'none'` (or the one legit embedder), `Referrer-Policy: strict-origin-when-cross-origin`.212. **TLS everywhere, including service-to-service.** Redirect HTTP→HTTPS at the edge; internal traffic gets mTLS or a private mesh — "internal" networks are not trusted.223. **Secrets never live in code or VCS.** Environment variables or a secret manager; distinct secrets per environment; rotate immediately on any exposure and treat the git history as public once pushed.234. **Dependencies: lockfile + scanner + cadence.** Commit the lockfile, run `pip-audit`/`npm audit`/Dependabot in CI, patch criticals within days not quarters.245. **SSRF: user-supplied URLs are hostile.**25   - ✅ Allowlist destination hosts; resolve DNS and reject private/link-local ranges (10.x, 172.16–31, 192.168, 169.254, ::1); disable redirects or re-check after each hop26   - ❌ `requests.get(user_url)` — hello, cloud metadata endpoint276. **CSRF tokens for every cookie-authenticated state change.** SameSite helps but is not sufficient (top-level POST exemptions, old clients); use the framework's CSRF middleware.287. **Errors never leak internals.** Map exceptions to problem+json with a correlation ID; stack traces, SQL, and versions go to logs only.298. **Service accounts get least privilege** — scoped API keys, no wildcard IAM, one identity per service so revocation is surgical.3031## Workflow32331. Inventory: endpoints, secrets, outbound URL fetches, cookie-authenticated mutations, third-party dependencies.342. Apply rules 1–2 at the middleware/edge layer (one place, not per route).353. Move any in-code secrets out (rule 3) and rotate them — moving without rotating fixes nothing.364. Add SSRF/CSRF defenses where the inventory found exposure (rules 5–6); wire the error mapper (rule 7).375. **Validate:** `curl -sI` each surface and confirm the rule-1 headers; run the dependency scanner to zero criticals; request a known-bad internal URL through any fetch feature (expect rejection); trigger an exception and confirm the response body contains no stack trace. All four must pass.3839## Edge cases & failure modes40- **CSP breaks inline scripts** → prefer nonces (`'nonce-...'`) over loosening to `unsafe-inline`.41- **Header set twice (app + proxy)** → duplicated CSP is intersected by browsers; set each header in exactly one layer.42- **Webhooks/health checks behind mTLS** → give external callers a dedicated ingress with its own auth, don't weaken the default.43- **Secret manager outage** → cache secrets in memory with TTL; never fall back to a baked-in default secret.4445## References46Copy-paste patterns and gotchas: see [references/patterns.md](references/patterns.md).47