feat: implement HTTPS enforcement and secure cookie settings

[devin-ai-integration]

feat: implement comprehensive HTTPS and transport security

Summary

This PR implements comprehensive HTTPS and transport security across both the bank-server (NestJS backend) and bank-client (React frontend) to enforce secure communications and protect against common web vulnerabilities.

Key Changes:

• HTTPS Enforcement: Added production middleware to redirect HTTP to HTTPS
• HSTS Headers: Configured HTTP Strict Transport Security with 1-year max-age and subdomain inclusion
• Content Security Policy: Implemented restrictive CSP directives to prevent XSS attacks
• Secure Cookies: Enhanced JWT token handling and cookie consent with secure attributes
• Certificate Pinning Foundation: Added security utilities for future certificate validation

Review & Testing Checklist for Human

• Test application startup and core functionality - I couldn't test locally due to database connection issues, so verify both applications start correctly and authentication flows work
• Verify HTTPS redirects in production environment - Test that HTTP requests properly redirect to HTTPS in production deployment
• Review certificate pinning implementation - The current implementation is a placeholder with dummy fingerprints that needs real certificate validation logic
• Validate CSP policy compatibility - The restrictive Content Security Policy might block legitimate resources; test all application features
• Check secure cookie settings - Ensure the new cookie security attributes don't break existing authentication or GDPR consent flows

Recommended Test Plan:

1. Deploy to staging environment and verify HTTPS redirects work
2. Test login/logout flows to ensure JWT cookies work with new security attributes
3. Use browser dev tools to verify HSTS headers are present
4. Check console for any CSP violations during normal application usage
5. Test GDPR cookie consent functionality with new secure attributes

---

Diagram

%%{ init : { "theme" : "default" }}%%
graph TD
    subgraph "Bank Server (NestJS)"
        A["src/main.ts<br/>Bootstrap & Security"]:::major-edit
        B["src/modules/auth/services/auth.service.ts<br/>JWT Token Generation"]:::minor-edit
        C["src/modules/auth/dtos/token-payload.dto.ts<br/>Token Response DTO"]:::minor-edit
    end
    
    subgraph "Bank Client (React)"
        D["app/utils/api.js<br/>API Configuration"]:::minor-edit
        E["app/components/ConstantCookie/index.js<br/>GDPR Cookie Consent"]:::minor-edit
        F["app/utils/security.js<br/>Certificate Pinning"]:::major-edit
    end
    
    A -->|"HTTPS redirect<br/>HSTS headers"| D
    B -->|"Secure JWT cookies"| E
    F -->|"Certificate validation<br/>(placeholder)"| D
    
    subgraph Legend
        L1["Major Edit"]:::major-edit
        L2["Minor Edit"]:::minor-edit
        L3["Context/No Edit"]:::context
    end
    
    classDef major-edit fill:#90EE90
    classDef minor-edit fill:#87CEEB
    classDef context fill:#FFFFFF

Loading

Notes

Security Enhancements Implemented:

• HTTPS redirect middleware with x-forwarded-proto header detection
• HSTS headers with preload directive for maximum security
• Restrictive CSP policy allowing only same-origin resources with specific exceptions
• JWT tokens now include secure cookie options (httpOnly, secure, sameSite)
• GDPR cookie consent enhanced with secure attributes
• Certificate pinning foundation (requires real fingerprints for production)

Important Limitations:

• Certificate pinning is currently a placeholder implementation with dummy fingerprints
• Could not test locally due to database connection issues
• CSP policy is restrictive and may need adjustments based on actual resource requirements

Session Info:

• Link to Devin run: https://app.devin.ai/sessions/617dc3abba3145ab8d3af17625453ae4
• Requested by: @akkp-windsurf

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring