Encryption

The Care Nexus implements multiple layers of encryption to protect sensitive data both in transit and at rest. The three main cryptographic mechanisms are AES-256 for message content, bcrypt for password hashing, and signed JWTs for authentication tokens.

Message Encryption (AES-256)

All chat messages are encrypted before storage using AES-256-CBC. The messageCrypto.js utility handles encryption on write and decryption on read. The encryption key is a 32-byte secret derived from the MESSAGE_ENCRYPTION_KEY environment variable — it never leaves the server. Clients always receive plaintext messages after server-side decryption; the encryption is transparent to the UI.

const crypto = require('crypto');
const ALGO = 'aes-256-cbc';
const KEY  = Buffer.from(process.env.MESSAGE_ENCRYPTION_KEY, 'hex');

function encrypt(text) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv(ALGO, KEY, iv);
  const encrypted = Buffer.concat([cipher.update(text), cipher.final()]);
  return iv.toString('hex') + ':' + encrypted.toString('hex');
}

function decrypt(payload) {
  const [ivHex, encHex] = payload.split(':');
  const iv = Buffer.from(ivHex, 'hex');
  const decipher = crypto.createDecipheriv(ALGO, KEY, iv);
  return Buffer.concat([
    decipher.update(Buffer.from(encHex, 'hex')),
    decipher.final()
  ]).toString();
}

Password Hashing (bcrypt)

User passwords are never stored in plaintext. On registration, the password is hashed using bcrypt with a work factor of 12 rounds before being saved to MongoDB. On login, bcrypt's compare function verifies the submitted password against the stored hash — the original password is never reconstructed or logged.

Password reset tokens are SHA-256 hashed before storage, ensuring they cannot be reused even if the database is compromised.

JWT Token Security

Access tokens are signed using HS256 with a strong secret and expire in 15 minutes. Refresh tokens last 7 days and are stored in Redis, allowing instant session invalidation by deleting the Redis key.

Transport Security

All production traffic is served over HTTPS with enforced SSL. Socket.IO connections also run over WSS (WebSocket Secure) in production environments.