Skip to content
TradeX Chart

Security Considerations

Security Considerations

Essential security practices to protect your TradeX Chart application and user data.

Input Validation

Validate User Inputs

function validateSymbol(symbol) {
  if (!/^[A-Z0-9]{2,10}$/.test(symbol)) {
    throw new Error('Invalid symbol format')
  }
  return symbol
}

function validateTimeframe(timeframe) {
  const validTimeframes = ['1m', '5m', '15m', '1h', '4h', '1d']
  if (!validTimeframes.includes(timeframe)) {
    throw new Error('Invalid timeframe')
  }
  return timeframe
}

// Usage
try {
  const symbol = validateSymbol(userInput)
  const timeframe = validateTimeframe(userTimeframe)
  loadChartData(symbol, timeframe)
} catch (error) {
  console.error('Validation error:', error)
}

Sanitize Data

function sanitizeOHLCV(data) {
  if (!Array.isArray(data)) {
    throw new Error('Data must be an array')
  }
  
  return data.map(candle => {
    if (!Array.isArray(candle) || candle.length < 5) {
      throw new Error('Invalid candle format')
    }
    
    return [
      parseInt(candle[0], 10),
      parseFloat(candle[1]),
      parseFloat(candle[2]),
      parseFloat(candle[3]),
      parseFloat(candle[4]),
      parseFloat(candle[5] || 0)
    ].map(val => {
      if (isNaN(val) || !isFinite(val)) {
        throw new Error('Invalid numeric value')
      }
      return val
    })
  })
}

API Security

Secure API Keys

// ❌ Bad: Hardcoded API key
const API_KEY = 'sk_live_1234567890abcdef'

// ✅ Good: Environment variable
const API_KEY = process.env.API_KEY

// ✅ Good: Server-side proxy
fetch('/api/chart-data')

app.get('/api/chart-data', async (req, res) => {
  const response = await fetch('https://api.example.com/data', {
    headers: {
      'Authorization': `Bearer ${process.env.API_KEY}`
    }
  })
  res.json(await response.json())
})

Rate Limiting

const rateLimit = require('express-rate-limit')

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: 'Too many requests, please try again later',
  standardHeaders: true,
  legacyHeaders: false
})

app.use('/api/', apiLimiter)

HTTPS/TLS

Enforce HTTPS

app.use((req, res, next) => {
  if (req.header('x-forwarded-proto') !== 'https' && process.env.NODE_ENV === 'production') {
    res.redirect(`https://${req.header('host')}${req.url}`)
  } else {
    next()
  }
})

Secure WebSocket

// ❌ Bad: Insecure WebSocket
const ws = new WebSocket('ws://api.example.com')

// ✅ Good: Secure WebSocket
const ws = new WebSocket('wss://api.example.com')

// ✅ Good: Auto-detect protocol
const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:'
const ws = new WebSocket(`${protocol}//${window.location.host}/ws`)

Content Security Policy (CSP)

Configure CSP Headers

const helmet = require('helmet')

app.use(
  helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: [
        "'self'",
        "'unsafe-inline'",
        'https://cdn.jsdelivr.net',
        'https://unpkg.com'
      ],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", 'data:', 'https:'],
      connectSrc: [
        "'self'",
        'https://api.example.com',
        'wss://api.example.com'
      ],
      fontSrc: ["'self'", 'https://fonts.gstatic.com'],
      objectSrc: ["'none'"],
      mediaSrc: ["'self'"],
      frameSrc: ["'none'"]
    }
  })
)

Security Checklist

  • Validate all user inputs
  • Sanitize data from external sources
  • Use HTTPS everywhere
  • Implement CSP headers
  • Configure CORS properly
  • Use secure authentication
  • Prevent XSS attacks
  • Implement CSRF protection
  • Encrypt sensitive data
  • Secure WebSocket connections
  • Audit dependencies regularly
  • Use security headers
  • Implement rate limiting
  • Don’t expose sensitive errors
  • Sanitize logs