68 lines
8.0 KiB
Markdown
68 lines
8.0 KiB
Markdown
# WRNexusJS 0.7.0 — 21-Point Security and Performance Implementation
|
|
|
|
WRNexusJS 0.7.0 implements the framework-side foundations for all 21 requested security and performance areas. Secure defaults, compiler diagnostics, runtime enforcement, production reports, release gates, and adapter interfaces are included in this source release.
|
|
|
|
External infrastructure remains an application/deployment responsibility: TLS termination, Redis or another distributed cache, antivirus/CDR engines, image transcoding services, CDN configuration, an OTLP/metrics backend, database indexes, registry MFA, and project-specific authorization policy.
|
|
|
|
## Implementation matrix
|
|
|
|
| # | Area | Implemented in 0.7.0 |
|
|
| --: | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| 1 | Targets and budgets | Expanded route, CSS, HTML, image, hydration, SSR, Web Vitals, request-count, and long-task budgets with warning/error enforcement and build reporting. |
|
|
| 2 | Compiler/template security | Context-aware URL validation, unsafe protocol diagnostics, dangerous DOM/dynamic-code diagnostics, client/server boundary checks, persisted-secret checks, Trusted HTML policy, and bounded secure hydration serialization. |
|
|
| 3 | Browser headers | CSP with nonce/report-only support, Trusted Types, HSTS, COOP, CORP, Referrer-Policy, Permissions-Policy, nosniff, frame protection, Origin-Agent-Cluster, and presets. |
|
|
| 4 | Sessions/authentication | Idle and absolute expiry, sliding access, secure cookie defaults, server-side session backend support, and safer session lifecycle configuration. |
|
|
| 5 | CSRF/CORS/authorization | CSRF token plus Origin and Fetch Metadata validation, opt-in exact-origin CORS, and continued server-side authz/tenant policy enforcement. |
|
|
| 6 | Gateway/API hardening | URL/header/query/body limits, timeouts, concurrency limits, host/proxy trust, request IDs, IP rate limits, Fetch Metadata, access logs, and WebSocket queue/origin/message controls. |
|
|
| 7 | SSRF | Safe fetch validates protocols and hosts, resolves and checks addresses, blocks private/special networks, revalidates redirects, limits size/time/redirects, and avoids credential forwarding. |
|
|
| 8 | Uploads | Extension/MIME/size/aggregate/path controls, generated names, secure download disposition, inspector hooks, and antivirus/CDR adapter interfaces. |
|
|
| 9 | Database | Query timing, timeouts, row caps, slow-query reporting, duplicate/N+1 detection, SELECT-star/unbounded-query warnings, and per-request query records. |
|
|
| 10 | SSR/server | Runtime route classification, zero-JS/prerender analysis, request dedupe and cache foundations, streaming compatibility, and build-report visibility. |
|
|
| 11 | Hydration/CSR | Static pages default to zero framework JavaScript, auto/client/document navigation modes, partial/lazy hydration foundations, batched reactive work, keyed updates, cancellation/disposal, and hydration telemetry. |
|
|
| 12 | Build/bundles | Server/client separation, minification/hashing support, immutable runtime assets, runtime classification, production build reports, and enforceable budgets. |
|
|
| 13 | CSS | Existing minification/token tooling plus diagnostics for transition-all, expensive blur/shadow patterns, broad selectors, and duplicate keyframes. |
|
|
| 14 | Images/icons/fonts | Responsive image planning, srcset/sizes/dimensions/loading/decoding/fetch-priority policy, remote-host validation, LCP/oversizing audits, and continued per-icon/font optimization helpers. |
|
|
| 15 | HTTP delivery | Brotli-first negotiation, gzip fallback, compression exclusions, ETags/conditional responses, immutable assets, cache-control helpers, stale policies, and preload/modulepreload support. |
|
|
| 16 | Realtime/WebSocket | Authentication, origins, message byte/rate/depth limits, room/user quotas, schema and authorization predicates, prototype-pollution rejection, and gateway backpressure controls. |
|
|
| 17 | Observability | Counters, gauges, histograms, HTTP middleware, request/error/active-request metrics, same-origin Web Vitals, browser collector, exporters, and Server-Timing integration. |
|
|
| 18 | DevToolbar | Security checks for forms/CSRF/CSP/mixed content/storage/hydration leaks and performance checks for transfer, DOM, hydration, images, blocking assets, and long tasks. |
|
|
| 19 | Tests/release gates | 0.7 validator, production security audit, benchmark budgets, type/lint/test/format pipeline, deterministic UI references, stage integrity checks, and compatibility validation. |
|
|
| 20 | Supply chain | Private release policy, aligned versions, explicit migration, deterministic CycloneDX SBOM, secret/source-map/source leakage scanning, package SHA-256 manifests, and clean/pushed Git requirements. |
|
|
| 21 | New packages | `@wrnexus/security`, `@wrnexus/cache`, `@wrnexus/image`, `@wrnexus/observability`, and `@wrnexus/benchmark`. |
|
|
|
|
## Compatibility
|
|
|
|
- Existing 0.6 component, parser, store, RPC, and runtime contracts remain supported.
|
|
- The updater preserves existing security, performance, observability, and navigation configuration.
|
|
- New projects use `navigation.mode: "auto"`; fully static routes ship no WRNexusJS JavaScript.
|
|
- Set `navigation.mode: "client"` only when every route requires in-place client navigation.
|
|
|
|
## Mandatory project review before production
|
|
|
|
Framework controls do not replace application-specific review. Each production project must define and test:
|
|
|
|
- Roles, permissions, object ownership, tenant boundaries, and sensitive field access.
|
|
- CSP source allowlists and third-party scripts.
|
|
- Trusted proxies, public hosts, CORS origins, WebSocket origins, and outbound URL allowlists.
|
|
- Session duration, MFA/passkey requirements, recovery policy, and high-risk reauthentication.
|
|
- Upload type policy, storage isolation, antivirus/CDR adapters, quotas, and retention.
|
|
- Cache privacy and invalidation for authenticated or tenant-specific data.
|
|
- Database indexes, pool sizes, query limits, backups, and migration rollback.
|
|
- Observability retention, sampling, redaction, and incident alerts.
|
|
- CDN/TLS configuration, registry MFA, short-lived publish credentials, and disaster recovery.
|
|
|
|
## Production gates
|
|
|
|
```sh
|
|
bun install
|
|
bun run validate:0.7
|
|
bun run security:framework
|
|
bun run sbom
|
|
bun run benchmark:framework
|
|
bun run validate:staging
|
|
bun run check
|
|
bun run release:prepare
|
|
```
|
|
|
|
Run `release:private` only after generated files and release changes are committed, pushed, and the working tree is clean.
|