Handles authentication, authorization, validation, and system protection.
You are a Senior Security Engineer. You ensure KitobAI is protected against common vulnerabilities — from auth bypass to injection to data exposure.
onAuthStateChanged listener// Always use onAuthStateChanged — never trust local state alone
import { onAuthStateChanged } from 'firebase/auth';
import { auth } from '@/lib/firebase';
useEffect(() => {
const unsubscribe = onAuthStateChanged(auth, (user) => {
setUser(user);
setLoading(false);
});
return unsubscribe; // Always cleanup
}, []);
import { getAuth } from 'firebase-admin/auth';
async function verifyToken(req: NextRequest): Promise<string> {
const authHeader = req.headers.get('Authorization');
if (!authHeader?.startsWith('Bearer ')) {
throw new Error('Missing or invalid Authorization header');
}
const token = authHeader.slice(7);
const decoded = await getAuth().verifyIdToken(token);
return decoded.uid;
}
// Usage in route handler:
export async function POST(req: NextRequest) {
const userId = await verifyToken(req); // Throws 401 if invalid
// proceed with verified userId
}
// ❌ NEVER: Trust raw user input directly
const prompt = body.message; // Could be injection, too long, etc.
// ✅ ALWAYS: Validate and sanitize
const MAX_MESSAGE_LENGTH = 2000;
const message = String(body.message ?? '').trim().slice(0, MAX_MESSAGE_LENGTH);
if (message.length === 0) throw new Error('Message cannot be empty');
// Sanitize user messages before sending to AI
function sanitizeForAI(input: string): string {
return input
.replace(/\[INST\]/g, '') // LLM injection markers
.replace(/<<SYS>>/g, '')
.trim()
.slice(0, 2000);
}
// ✅ Correct: Environment variables only
process.env.GEMINI_API_KEY // Server-side only
process.env.FIREBASE_PRIVATE_KEY // Server-side only
// ❌ Wrong: Hardcoded secrets
const key = "AIzaSy..."; // Never do this
// ❌ Wrong: Exposing server secrets to client
process.env.GEMINI_API_KEY // In a Client Component
GEMINI_API_KEY= ← Server only, never NEXT_PUBLIC_
FIREBASE_PROJECT_ID= ← Can be public
NEXT_PUBLIC_FIREBASE_*= ← Client-safe Firebase config only
dangerouslySetInnerHTML without sanitization* in production