portfolio/SECURITY_IMPROVEMENTS.md

🔒 Security Improvements

Implemented Security Features

1. n8n API Endpoint Protection

All n8n endpoints are now protected with:

• Authentication: Admin authentication required for sensitive endpoints (/api/n8n/generate-image)
• Rate Limiting:
  • /api/n8n/generate-image: 10 requests/minute
  • /api/n8n/chat: 20 requests/minute
  • /api/n8n/status: 30 requests/minute

2. Email Obfuscation

Email addresses can now be obfuscated to prevent automated scraping:

import { createObfuscatedMailto } from '@/lib/email-obfuscate';
import { ObfuscatedEmail } from '@/components/ObfuscatedEmail';

// React component
<ObfuscatedEmail email="contact@dk0.dev">Contact Me</ObfuscatedEmail>

// HTML string
const mailtoLink = createObfuscatedMailto('contact@dk0.dev', 'Email Me');

How it works:

• Emails are base64 encoded in the HTML
• JavaScript decodes them on click
• Prevents simple regex-based email scrapers
• Still functional for real users

3. URL Obfuscation

Sensitive URLs can be obfuscated:

import { createObfuscatedLink } from '@/lib/email-obfuscate';

const link = createObfuscatedLink('https://sensitive-url.com', 'Click Here');

4. Rate Limiting

All API endpoints have rate limiting:

• Prevents brute force attacks
• Protects against DDoS
• Configurable per endpoint

Code Obfuscation

Note: Full code obfuscation for Next.js is not recommended because:

1. Next.js already minifies code in production builds
2. Obfuscation breaks source maps (harder to debug)
3. Performance impact (slower execution)
4. Not effective - determined attackers can still reverse engineer
5. Maintenance burden - harder to debug issues

Better alternatives:

• ✅ Minification (already enabled in Next.js)
• ✅ Environment variables for secrets
• ✅ Server-side rendering (code not exposed)
• ✅ API authentication
• ✅ Rate limiting
• ✅ Security headers

Best Practices

For Email Protection:

1. Use obfuscated emails in public HTML
2. Use contact forms instead of direct mailto links
3. Monitor for spam patterns

For API Protection:

1. Always require authentication for sensitive endpoints
2. Use rate limiting
3. Log suspicious activity
4. Use HTTPS only
5. Validate all inputs

For Webhook Protection:

1. Use secret tokens (N8N_SECRET_TOKEN)
2. Verify webhook signatures
3. Rate limit webhook endpoints
4. Monitor webhook usage

Implementation Status

• ✅ n8n endpoints protected with auth + rate limiting
• ✅ Email obfuscation utility created
• ✅ URL obfuscation utility created
• ✅ Rate limiting on all n8n endpoints
• ⚠️ Email obfuscation not yet applied to pages (manual step)
• ⚠️ Code obfuscation not implemented (not recommended)

Next Steps

To apply email obfuscation to your pages:

1. Import the utility:

import { ObfuscatedEmail } from '@/lib/email-obfuscate';

2. Replace email links:

// Before
<a href="mailto:contact@dk0.dev">Contact</a>

// After
<ObfuscatedEmail email="contact@dk0.dev">Contact</ObfuscatedEmail>

3. For static HTML, use the string function:

const html = createObfuscatedMailto('contact@dk0.dev', 'Email Me');