Phase 1: Critical Security Fixes 🔒

Overview

This PR addresses critical security vulnerabilities identified in the Learnify PRD Phase 1. All changes are focused on enhancing security and production-readiness.

📋 Changes Summary

🔒 Security Improvements

1. Authorization Fix in CoursesController.Update()

Before:

// TODO: Add authorization check to ensure user owns this course
// For now, we'll let the command handler deal with authorization

After:

// Authorization check: Ensure user is admin or course owner
var isAdmin = User.IsInRole("Admin");
var course = await _mediator.Send(new GetCourseByIdQuery(id));

if (course == null)
    return NotFound();

if (!isAdmin && course.InstructorId != currentUserId)
    return Forbid("Only course owners or administrators can update courses");

Impact: Users can no longer modify courses they don't own.

2. Restrictive CORS Policy

Added:

• ProductionCors - Restricts to allowed origins from configuration
• DevelopmentCors - Allows all origins for local testing
• Environment-based policy switching

Configuration (appsettings.json):

"AllowedOrigins": [
  "http://localhost:3000",
  "http://localhost:5173",
  "https://localhost:3000",
  "https://yourdomain.com"
]

Impact: Eliminates AllowAnyOrigin() security vulnerability.

3. HTTPS Enforcement

Added:

if (!app.Environment.IsDevelopment())
{
    app.UseHttpsRedirection();
    app.UseHsts();
}

Impact: All production traffic is forced to HTTPS.

4. Clean Build

Removed: Duplicate FluentValidation package reference.

Impact: Eliminates potential build conflicts.

🧪 Testing Checklist

• Test course update with non-owner user → Should return 403 Forbidden
• Test course update with admin user → Should succeed
• Test course update with course owner → Should succeed
• Test CORS in production → Only origins from AllowedOrigins accepted
• Test CORS in development → All origins allowed
• Test HTTP request in production → Should redirect to HTTPS
• Build completes without warnings
• All existing tests pass

📊 Risk Assessment

🔄 Backward Compatibility

Breaking Changes: None

Configuration Required: Yes - Add AllowedOrigins to appsettings.json for production.

📝 Related Issues

• Closes Phase 1 of Learnify PRD
• Addresses critical security vulnerabilities
• Part of prioritized roadmap (Week 1-2)

✨ Next Steps (After Merge)

• Phase 2: Testing & Quality (Test framework, unit tests, integration tests)
• Phase 3: Security & Monitoring (JWT blacklisting, CAPTCHA, Sentry)

Reviewer: Please verify:

1. Authorization logic matches security requirements
2. CORS configuration is appropriate for production
3. HTTPS enforcement works as expected
4. No breaking changes introduced