Skaltro

skaltro

According to recent studies, over 80% of data breaches can be prevented by implementing improved secure coding practices. As such, it is imperative to incorporate these practices into your organization's software development processes. In software engineering, it's not only about improving performance and optimizing processes. Ensuring security and practicing secure is also crucial, regardless of your role as a developer, quality assurance specialist, or cloud engineer. Security should always be a top priority. coding And that is what we will be discussing today in this article. Here are some common secure coding practices that you can use in your daily work when creating a new feature or developing an app. Preventing SQL Injection Preventing Cross-Site Scripting (XSS) Testing Security with Selenium Secure Password Storage and Handling Cross-Site Request Forgery (CSRF) Protection Secure Session Management Content Security Policy (CSP) Implementation Handling Error Messages Securely Secure File Uploads Logging and Auditing for Security Monitoring Let's start Preventing SQL Injection SQL injection is a common way for malicious actors to attack web applications by taking advantage of poorly sanitized user inputs to manipulate the database. This vulnerability can lead to unauthorized access to sensitive information, alteration or deletion of data, and even administrative control of the application. It is crucial to address this issue to maintain data integrity, build user trust, and prevent serious . Ignoring this vulnerability could result in data leaks, unauthorized access, and harm to your application's reputation. security breaches of not following secure coding practice Bad Example /** 
Here user input (userId) is directly interpolated into the SQL query,
leaving the application vulnerable to SQL injection.
*/
 
const userId = req.params.id
const query = `SELECT * FROM users WHERE id = ${userId}`
db.query(query, (err, result) => {
	// Process the query result
}) of secure coding practice Good Example /**
Here parameterized queries are used, which ensures proper handling of
user input, preventing SQL injection attacks.
*/
 
const userId = req.params.id
const query = 'SELECT * FROM users WHERE id = ?'
db.query(query, [userId], (err, result) => {
	// Process the query result
}) Cross-Site Scripting (XSS) It's really important to make sure that web applications are protected from Cross-Site Scripting (XSS) attacks for your safety. These attacks can let hackers inject malicious scripts into web apps, which then get executed in the browsers of unsuspecting users. This can lead to all sorts of bad things like data theft, financial loss, and unauthorized access to your accounts. If you don't take steps to secure your frontend, you might end up losing the trust of your users and even facing legal consequences. of not following secure coding practice Bad Example import React, { useState } from 'react'
 
const Component = () => {
	const [inputText, setInputText] = useState('')
	const [htmlString, setHtmlString] = useState('')
 
	const handleInputChange = (e) => {
		setInputText(e.target.value)
	}
 
	const handleHtmlStringSubmit = () => {
		// inputText is used directly.
		setHtmlString(`<div>${inputText}</div>`)
	}
 
	return (
		<div>
			<input type='text' value={inputText} onChange={handleInputChange} />
			<button onClick={handleHtmlStringSubmit}>Submit</button>
			<div>
				<h3>HTML:</h3>
				<div dangerouslySetInnerHTML={{ __html: htmlString }} />
			</div>
		</div>
	)
}
 
export default Component following secure code practice Good Example import React, { useState } from 'react'
 
const Component = () => {
	const [inputText, setInputText] = useState('')
	const [htmlString, setHtmlString] = useState('')
 
	const handleInputChange = (e) => {
		setInputText(e.target.value)
	}
 
	const handleHtmlStringSubmit = () => {
		setHtmlString(`<div>${inputText}</div>`)
	}
 
	return (
		<div>
			<input type='text' value={inputText} onChange={handleInputChange} />
			<button onClick={handleHtmlStringSubmit}>Submit</button>
			<div>
				<h3>HTML:</h3>
				{/* htmlString is sanitized properly */}
				<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(htmlString) }} />
			</div>
		</div>
	)
}
 
export default Component Testing Security with Selenium Security testing is a crucial aspect of software development that allows us to identify and address potential vulnerabilities and weaknesses in our applications. It involves simulating real-world attack scenarios to assess how well our defenses hold up against malicious intent. In our talk, we've already explored secure coding practices to secure our code against common threats like and Cross-Site Scripting (XSS). Now, with Selenium, we venture into the realm of automated testing, empowering us to conduct thorough and repeatable security tests. SQL injection Example with taken into consideration Security Testing import org.openqa.selenium.By;
import org.openqa.selenium.WebDriver;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.support.ui.ExpectedConditions;
import org.openqa.selenium.support.ui.WebDriverWait;
 
public class LoginTestGood {
    public static void main(String[] args) {
        WebDriver driver = new ChromeDriver();
        try {
            // Step 1: Open the login page
            driver.get("https://example.com/login");
 
            // Step 2: Perform security test for SQL injection
            String maliciousInput = "'; DROP TABLE users; --"; // Simulating SQL injection payload
            WebElement usernameField = driver.findElement(By.name("username"));
            WebElement passwordField = driver.findElement(By.name("password"));
            usernameField.sendKeys(maliciousInput);
            passwordField.sendKeys("secret123");
            passwordField.submit();
 
            // Step 3: Wait for the login to complete (here we wait for an element on the login page to check for failure)
            WebDriverWait wait = new WebDriverWait(driver, 10);
            wait.until(ExpectedConditions.presenceOfElementLocated(By.cssSelector(".login-form")));
 
            System.out.println("Test (good) - SQL Injection attempt detected");
        } catch (Exception e) {
            System.err.println("Test (good) - Security test passed: " + e.getMessage());
        } finally {
            driver.quit();
        }
    }
} Secure Password Storage and Handling It is essential to store and handle passwords correctly to safeguard user accounts from unauthorized access, regardless of whether the application's database is compromised. Improper password storage practices, like storing passwords in plain text or weakly hashed formats, can result in password leaks that compromise user safety. is where we are storing passwords directly in DB, and this can compromise the security of our app. A bad example app.post('/register', (req, res) => {
	const username = req.body.username
	const password = req.body.password
 
	// Store the user in the database with the password as-is
}) is where the password is encrypted and stored in DB. A good example const bcrypt = require('bcrypt')
 
app.post('/register', async (req, res) => {
	const username = req.body.username
	const password = req.body.password
 
	const saltRounds = 10
	const hashedPassword = await bcrypt.hash(password, saltRounds)
 
	// Store the user in the database with the hashedPassword
}) Cross-Site Request Forgery (CSRF) Protection CSRF is an attack that tricks users into submitting unintended requests by exploiting their authenticated session. Proper CSRF protection is essential to prevent attackers from performing unauthorized actions on behalf of the user. Without CSRF protection, attackers can execute malicious actions on behalf of authenticated users, leading to account compromise and unauthorized data manipulation. where a form is created for changing passwords without the support of a CSRF token. Bad Example import { useState } from 'react'
 
const PasswordChangeForm = () => {
	const [newPassword, setNewPassword] = useState('')
 
	const handleChange = (event) => {
		setNewPassword(event.target.value)
	}
 
	const handleSubmit = (event) => {
		event.preventDefault()
 
		// Send the password change request without CSRF token
		fetch('/change_password', {
			method: 'POST',
			body: JSON.stringify({ newPassword }),
			headers: {
				'Content-Type': 'application/json',
			},
		})
			.then((response) => response.json())
			.then((data) => {
				console.log(data)
				// Handle response data
			})
			.catch((error) => {
				console.error('Error:', error)
				// Handle error
			})
	}
 
	return (
		<form onSubmit={handleSubmit}>
			<label htmlFor='newPassword'>New Password:</label>
			<input type='password' id='newPassword' name='newPassword' value={newPassword} onChange={handleChange} />
			<button type='submit'>Change Password</button>
		</form>
	)
}
 
export default PasswordChangeForm where the support of CSRF token is provided for better security. Good Example import { useState } from 'react'
 
const PasswordChangeForm = ({ csrfToken }) => {
	const [newPassword, setNewPassword] = useState('')
 
	const handleChange = (event) => {
		setNewPassword(event.target.value)
	}
 
	const handleSubmit = (event) => {
		event.preventDefault()
 
		// Send the password change request with CSRF token
		fetch('/change_password', {
			method: 'POST',
			body: JSON.stringify({ newPassword }),
			headers: {
				'Content-Type': 'application/json',
				'CSRF-Token': csrfToken, // Include CSRF token in the request header
			},
		})
			.then((response) => response.json())
			.then((data) => {
				console.log(data)
				// Handle response data
			})
			.catch((error) => {
				console.error('Error:', error)
				// Handle error
			})
	}
 
	return (
		<form onSubmit={handleSubmit}>
			<label htmlFor='newPassword'>New Password:</label>
			<input type='password' id='newPassword' name='newPassword' value={newPassword} onChange={handleChange} />
			<button type='submit'>Change Password</button>
		</form>
	)
}
 
export default PasswordChangeForm

const express = require('express')
const bodyParser = require('body-parser')
const csurf = require('csurf')
 
const app = express()
app.use(bodyParser.json())
 
// Generate and include CSRF token for all responses
app.use(csurf())
 
// Middleware to expose CSRF token to the frontend
app.use((req, res, next) => {
	res.cookie('XSRF-TOKEN', req.csrfToken())
	next()
})
 
app.post('/change_password', (req, res) => {
	// Validate CSRF token before processing the request
	if (req.headers['csrf-token'] !== req.csrfToken()) {
		return res.status(403).json({ error: 'Invalid CSRF token.' })
	}
 
	const newPassword = req.body.newPassword
	// Process password change logic
	// ...
	res.json({ message: 'Password changed successfully.' })
})
 
app.listen(3000, () => {
	console.log('Server started on port 3000.')
}) Secure Session Management Secure Session Management is essential to prevent unauthorized access and session hijacking. If session management is insecure, it can lead to session hijacking, which allows attackers to impersonate users and gain access to sensitive information or perform actions on their behalf. where no session management is done Bad Example // Insecure session management using just plain HTTP cookies
app.get('/dashboard', (req, res) => {
	const user = findUserById(req.cookies.userId)
	// Display user dashboard
}) where Redis is used for session management, making the system more secure. Good Example // Secure session management
const session = require('express-session')
const RedisStore = require('connect-redis')(session)
 
const sessionConfig = {
	store: new RedisStore({ url: 'redis://localhost:6379' }),
	secret: 'secret_key',
	resave: false,
	saveUninitialized: false,
	cookie: {
		secure: true,
		httpOnly: true,
		maxAge: 3600000,
	},
}
 
app.use(session(sessionConfig))
 
app.get('/dashboard', (req, res) => {
	const user = findUserById(req.session.userId)
	// Display user dashboard
}) Content Security Policy (CSP) Implementation The Content Security Policy (CSP) plays a vital role in web application security by preventing . It does this by regulating the resources that are allowed to be loaded and executed on a web page. Cross-Site Scripting (XSS) attacks CSP accomplishes this by setting limits on which sources can be used for scripts, styles, fonts, images, and other resources, thereby reducing the potential risks of XSS vulnerabilities. where the React app does not include any Content Security Policy (CSP), leaving it vulnerable to various types of attacks, including Cross-Site Scripting ( ). Bad example XSS const ExampleApp = () => {
	return (
		<div>
			<h1>Welcome to My App</h1>
			<p>This is a vulnerable React application.</p>
			<script src='https://evil.com/malicious.js'></script>
		</div>
	)
}
 
export default ExampleApp where the server includes a CSP middleware that sets the "Content-Security-Policy" header in the HTTP response. The CSP is configured to only allow script sources from the same origin ('self'), the trusted CDN domain (' '), and scripts with the matching nonce value ('nonce-randomly_generated_nonce'). Good Example https://trusted-cdn.com const ExampleApp = () => {
	return (
		<div>
			<h1>Welcome to My Secure App</h1>
			<p>This is a secure React application with CSP.</p>
			<script src='https://trusted-cdn.com/app.js' nonce='randomly_generated_nonce'></script>
		</div>
	)
}
 
export default ExampleApp

const express = require('express')
const app = express()
 
// CSP middleware to set the Content-Security-Policy header
app.use((req, res, next) => {
	res.setHeader(
		'Content-Security-Policy',
		"script-src 'self' 'nonce-randomly_generated_nonce' https://trusted-cdn.com; default-src 'self'"
	)
	next()
})
 
// Serve the React application
app.use(express.static('build'))
 
app.listen(3000, () => {
	console.log('Server started on port 3000.')
}) Handling Error Messages Securely When an application encounters issues, error messages can offer useful feedback to both users and developers. However, if these messages are not handled properly, they can reveal sensitive information or help attackers identify potential vulnerabilities. where the whole user object is sent in response. Bad Example app.get('/user/:id', (req, res) => {
	const userId = req.params.id
	const user = getUserById(userId)
	if (!user) {
		return res.status(404).json({ error: 'User not found' })
	}
	res.json(user)
}) where only necessary details are sent in exposed. Good Example app.get('/user/:id', (req, res) => {
	const userId = req.params.id
	const user = getUserById(userId)
	if (!user) {
		return res.status(404).json({ error: 'User not found' })
	}
	res.json({ username: user.username, email: user.email })
}) Secure File Uploads Users can use file upload functionality to share data with the application. However, if this feature is not handled securely, it can become a vector for various attacks, such as code execution or denial of service. Insecure file uploads can have serious consequences, such as remote code execution or the storage of malicious files on the server. Therefore, it is crucial to implement secure file upload practices to prevent potential threats and maintain the integrity of the application. where the application allows users to upload files without proper validation and handling. The uploaded files are stored in the "uploads" directory, making them publicly accessible, which is a security risk. Additionally, the application does not check the file type or perform any security checks, leaving it vulnerable to malicious file uploads that may contain harmful scripts or malware. Bad Example const express = require('express')
const app = express()
const multer = require('multer')
 
app.use(express.static('uploads')) // Exposing the uploads directory
 
// Insecure file upload handling
const storage = multer.diskStorage({
	destination: (req, file, cb) => {
		cb(null, 'uploads/') // Uploading files to the "uploads" directory
	},
	filename: (req, file, cb) => {
		cb(null, file.originalname) // Using the original filename
	},
})
 
const upload = multer({ storage })
 
app.post('/upload', upload.single('file'), (req, res) => {
	// File processing logic (e.g., saving to the database)
	// ...
	res.send('File uploaded successfully.')
})
 
app.listen(3000, () => {
	console.log('Server started on port 3000.')
}) where the application implements secure file upload practices, including proper validation, file type checking, and storing files in a protected directory. Good Example const express = require('express')
const app = express()
const multer = require('multer')
const path = require('path')
const crypto = require('crypto')
 
// Secure file upload handling
const storage = multer.diskStorage({
	destination: (req, file, cb) => {
		cb(null, 'uploads/') // Uploading files to the "uploads" directory
	},
	filename: (req, file, cb) => {
		// Generate a unique filename to prevent overwriting
		const uniqueFilename = crypto.randomBytes(16).toString('hex')
		const fileExtension = path.extname(file.originalname)
		cb(null, uniqueFilename + fileExtension)
	},
})
 
const fileFilter = (req, file, cb) => {
	// Allow only specific file types (e.g., images)
	if (file.mimetype === 'image/jpeg' || file.mimetype === 'image/png' || file.mimetype === 'image/gif') {
		cb(null, true)
	} else {
		cb(new Error('Invalid file type. Only images (jpeg, png, gif) are allowed.'))
	}
}
 
const upload = multer({ storage, fileFilter })
 
app.post('/upload', upload.single('file'), (req, res) => {
	// File processing logic (e.g., saving to the database)
	// ...
	res.send('File uploaded successfully.')
})
 
app.listen(3000, () => {
	console.log('Server started on port 3000.')
}) Logging and Auditing for Security Monitoring Logging and auditing are crucial components of security monitoring, providing a detailed record of activities within the application. Properly implemented, they aid in detecting and responding to security incidents promptly. By utilizing security monitoring, developers and administrators can detect suspicious activities, unauthorized access attempts, and possible security breaches. However, without thorough logging and auditing, it can be difficult to effectively identify and investigate security incidents. Bad Example // Inadequate logging and auditing mechanisms
app.post('/data', (req, res) => {
	const sensitiveData = req.body.data
	// Process data without logging relevant events
}) where there is appropriate logging of sensitive actions and events, facilitating security monitoring and incident response. Good Example const fs = require('fs')
 
// Logging sensitive actions and events
app.post('/data', (req, res) => {
	const sensitiveData = req.body.data
	// Process data and log relevant events
	fs.appendFile('security.log', `Data processed: ${sensitiveData}\n`, (err) => {
		if (err) {
			console.error('Error writing to log file:', err)
		}
	})
}) And that's it. These were some secure coding practices, which, if incorporated into code, we can protect our app and the users. I hope you find this helpful. 🙌 On that note, I’ll take a leave until the next blog. We will learn something new in the next blog. If you are reading this blog till here, then do follow me on Twitter — @ShubhInTech Bye. Also published . here

A Handy Checklist of Secure Coding Practices: Protect Your App and Your Users

The one thing that developers tend to considers at the end of the development cycle is the “security” of the application. A secure application is not a luxury, it’s a necessity. You should consider the security of your application at every phase of the development such as architecture, design, code, and finally the deployment. Tutorial link: https://codeforgeek.com/a-guide-to-securing-node-js-applications In this tutorial, we are going to learn ways to secure our Node.js application. Let’s dive in. Data Validation – Never Trust Your Users You must always validate or sanitize the data coming from the user or other entity of the system. The bad validation or no validation at all is a threat to the working system and can lead to a security exploit. You should also escape the output. Let's learn how to validate the incoming data in Node.js. You can use a node module called to perform the data validation. For example. validator validator = ( );
validator.isEmail( ); validator.isEmail( ); const require 'validator' 'foo@bar.com' //=> true 'bar.com' //=> false You can also use a module called (recommended by Codeforgeek) to perform the data/schema validation. For example. joi joi = ( ); { schema = joi.object().keys({ : joi.string().min( ).max( ).required(), : joi.string().email().required(), : joi.string().min( ).max( ).required()
    }); dataToValidate = { : , : , : ,
    } result = schema.validate(dataToValidate); (result.error) { result.error.details[ ].message;
    }    
  } (e) { .log(e);
  } const require 'joi' try const name 3 45 email password 6 20 const name "Shahid" email "abc.com" password "123456" const if throw 0 catch console SQL Injection Attack SQL injection is an exploit where malicious users can pass unexpected data and change the SQL queries. Let's understand with the example. Assume your SQL query looks like this: UPDATE users
    SET first_name= WHERE id= ; "' + req.body.first_name +  '" 1332 In a normal scenario, you would expect that this query will look like this: UPDATE users
    SET first_name = WHERE id = ; "John" 1332 Now, if someone passes the first_name as the value shown below: John Wick ", last_name=" "; -- Then, your SQL query will look like this: UPDATE users
    SET first_name= , last_name= ; -- "John" "Wick" " WHERE id=1001; If you observe, the WHERE condition is commented out and now the query will update the users table and sets every user’s first name as “John” and last name as “Wick”. This will eventually lead to system failure and if your database has no backup, then you’re doomed. How to prevent SQL Injection attack The most useful way to prevent SQL injection attacks is to sanitize input data. You can either validate every single input or validate using parameter binding. Parameter binding is mostly used by the developers as it offers efficiency and security. If you are using a popular ORM such as sequelize, hibernate, etc then they already provide the functions to validate and sanitize your data. If you are using database modules other than ORM such as , you can use the escaping methods provided by the module. Let's learn by example. The codebase shown below is using module for Node. mysql for Node mysql mysql = ( ); connection = mysql.createConnection({ : , : , : , : });
 
connection.connect();

connection.query( ,
    [ ,req.body.first_name, , , ], { }); var require 'mysql' var host 'localhost' user 'me' password 'secret' database 'my_db' 'UPDATE users SET ?? = ? WHERE ?? = ?' 'first_name' 'id' 1001 ( ) function err, result //... The double question mark is replaced with the field name and the single question mark is replaced with the value. This will make sure that input is safe. You can also use a stored procedure to increase the level of security but due to lack of maintainability developers tend to avoid using stored procedures. You should also perform the server-side data validation. I do not recommend you to validate each field manually, you can use modules like . joi Typecasting JavaScript is a dynamic typed language i.e a value can be of any type. You can use the typecasting method to verify the type of data so that only the intended type of value should go into the database. For example, a user ID can only accept the number, there should be typecasting to ensure that the user ID should only be a number. For example, let's refer to the code we shown above. mysql = ( ); connection = mysql.createConnection({ : , : , : , : });
 
connection.connect();

connection.query( ,
    [ ,req.body.first_name, , , (req.body.ID)], { }); var require 'mysql' var host 'localhost' user 'me' password 'secret' database 'my_db' 'UPDATE users SET ?? = ? WHERE ?? = ?' 'first_name' 'id' Number ( ) function err, result //... Did you notice the change? We used to ensure that ID is always the number. You can refer to article by a fellow blogger to understand typecasting in depth. Number(req.body.ID) this beautiful Application Authentication and Authorization Sensitive data such as passwords should be stored in the system in a secure way that malicious users don't misuse sensitive information. In this section, we will learn how to store and manage passwords which are quite generic, and pretty much every application has passwords in some way in their system. Password Hashing Hashing is a function that generates a fixed-size string from input. The output from the hashing function cannot be decrypted hence it's "one-way" in nature. For data such as passwords, you must always use hashing algorithms to generate a hash version of the input password string which is a plaintext string. You might be wondering that if the hash is a one-way string then how come attackers gain access to passwords? Well, as I mentioned above, hashing takes an input string and generates a fixed-length output. So attackers take a reverse approach and they generate the hashes from the general password list, then they compare the hash with the hashes in your system to find the password. This attack is called attack. lookup tables This is the reason why you as an architect of the system must not allow generic used passwords in your system. To overcome this attack, you can something called . Salt is attached to the password hash to make it unique irrespective of the input. Salt has to be generated securely and randomly so that it is not predictable. The Hashing algorithm we suggest you is . At the time of writing this article, Bcrypt has not been exploited and considered cryptographically secure. In Node.js, you can use node module to perform the hashing. "salt" BCrypt bcyrpt Please refer to the example code below. bcrypt = ( ); saltRounds = ; password = ;

bcrypt.hash(
    password,
    saltRounds,
    (err, passwordHash) => { .log( , passwordHash);
}); const require 'bcrypt' const 10 const "Some-Password@2020" //we will just print it to the console for now //you should store it somewhere and never logs or print it console "Hashed Password:" The function is the cost of the hash function. The higher the cost, the more secure hash would be generated. You should decide the salt based on the computing power of your server. Once the hash is generated for a password, the password entered by the user will be compared to the hash stored in the database. Refer to the code below for reference. SaltRounds bcrypt = ( ); incomingPassword = ; existingHash = bcrypt.compare(
    incomingPassword,
    existingHash,
    (err, res) => { (res && res === ) { .log( );
        } { .log( );
        }
}); const require 'bcrypt' const "Some-Password@2020" const "some-hash-previously-generated" if true return console "Valid Password" //invalid password handling here else console "Invalid Password" Password Storage Whether you use the database, files to store passwords, you must not store a plain text version. As we studied above, you should generate the hash and store the hash in the system. I generally recommend using data type in case of a password. You can opt for an unlimited length field as well. If you are using then you can use field because will generate fixed size 60 character hashes. varchar(255) bcrypt varchar(60) bcrypt Authorization A system with proper user roles and permission prevents malicious users to act outside of their permission. To achieve a proper authorization process, proper roles and permissions are assigned to each user so that they can do certain tasks and nothing more. In Node.js, you can use a famous module called to develop access control lists based authorization in your system. ACL ACL = ( ); acl = ACL( ACL.memoryBackend()); acl.allow( , , ) acl.isAllowed( , , , (err, res) => { (res){ .log( );
    }
}); const require 'acl2' const new new // guest is allowed to view blogs 'guest' 'blogs' 'view' // check if the permission is granted 'joed' 'blogs' 'view' if console "User joed is allowed to view blogs" Checkout the acl2 documentation for more information and example code. Bruteforce Attack Prevention Bruteforce is an attack where a hacker uses software to try different passwords repetitively until access is granted i.e valid password is found. To prevent a Bruteforce attack, one of the simplest ways is to approach. When someone is trying to login into your system and tried an invalid password more than 3 times, make them wait for 60 seconds or so before trying again. This way the attacker is going to be slow and it's gonna take them forever to crack a password. wait it out Another approach to preventing it is to ban the IP that is generating invalid login requests. Your system allows 3 wrong attempts per IP in 24 hours. If someone tries to do brute-forcing then block the IP for 24 hours. This rate-limiting approach is been used by lots of companies to prevent brute-force attacks. If you are using the Express framework, there is a middleware module to enable rate-limiting in incoming requests. Its called . express=brute You can check the example code below. Install the dependency. npm install express-brute --save Enable it in your route. ExpressBrute = ( ); store = ExpressBrute.MemoryStore(); bruteforce = ExpressBrute(store);
 
app.post( ,
    bruteforce.prevent, {
        res.send( );
    }
); const require 'express-brute' const new // stores state locally, don't use this in production const new '/auth' // error 429 if we hit this route too often ( ) function req, res, next 'Success!' //... The example code is taken from module documentation. express-brute Secure Transmission using HTTPS It is 2021 and you must use HTTPS to send your data and traffic over the internet securely. HTTPS is an extension of the HTTP protocol with secure communication support. By using HTTPS, you can make sure that the traffic and your user's data over the internet is encrypted and safe. I am not going to explain how HTTPS works in the detail here. We are going to focus on the implementation part of it. I highly recommend you to use to generate the SSL certificates for all of your domain/subdomain. LetsEncrypt It's free and runs a daemon to update SSL certificates every 90 days. You can learn more about LetsEncrypt . You can opt for a domain-specific certificate or a wildcard certificate if you have multiple subdomains. LetsEncrypt supports both. here You can use LetsEncrypt for both Apache and Nginx based web servers. I highly recommend performing SSL negotiations in the reverse proxy or at the gateway layer because it is a heavy computing operation. Session Hijacking Prevention The session is an important part of any dynamic web application. Having a secure session in the application is a must for the users and systems safety. A session is implemented using cookies and it must be kept secure to prevent session hijacking. The following is a list of the attributes that can be set for each cookie and what they mean: – this attribute tells the browser to only send the cookie if the request is being sent over HTTPS. secure – this attribute is used to help prevent attacks such as cross-site scripting since it does not allow the cookie to be accessed via JavaScript. HttpOnly – this attribute is used to compare against the domain of the server in which the URL is being requested. If the domain matches or if it is a sub-domain, then the path attribute will be checked next. domain – in addition to the domain, the URL path that the cookie is valid for can be specified. If the domain and path match, then the cookie will be sent in the request. path – this attribute is used to set persistent cookies since the cookie does not expire until the set date is exceeded expires You can use npm module to perform session management in the Express framework. express-session express = ( ); session = ( ); app = express();

app.use(session({ : , : , : , : { : , : }
})); const require 'express' const require 'express-session' const secret 'keyboard cat' resave false saveUninitialized true cookie secure true path '/' You can learn more about Express session handling . here Cross Site Request Forgery (CSRF) Attack Prevention CSRF is an attack where that manipulates a trusted user of a system to execute unwanted malicious actions on a web application. In Node.js, we can use module to mitigate CSRF attack. This module requires either or to be initialized first. You can check out the example code below. csurf express-session cookie-parser express = ( ); cookieParser = ( ); csrf = ( ); bodyParser = ( ); csrfProtection = csrf({ : }); parseForm = bodyParser.urlencoded({ : }); app = express(); app.use(cookieParser());
 
app.get( , csrfProtection, { res.render( , { : req.csrfToken() });
});
 
app.post( , parseForm, csrfProtection, {
  res.send( );
});

app.listen( ); const require 'express' const require 'cookie-parser' const require 'csurf' const require 'body-parser' // setup route middlewares const cookie true const extended false // create express app const // we need this because "cookie" is true in csrfProtection '/form' ( ) function req, res // pass the csrfToken to the view 'send' csrfToken '/process' ( ) function req, res 'data is being processed' 3000 On the web page, you need to create a hidden input type with the value of the CSRF token. For example. <form action= method= > <input type="text" name="favoriteColor">
  <button type="submit">Submit</button>
</form> "/process" "POST" Favorite color: < = = = > input type "hidden" name "_csrf" value "{{csrfToken}}" In the case of AJAX requests, you can pass the CSRF token in the header. token = .querySelector( ).getAttribute( );
  headers: { : token
  } var document 'meta[name="csrf-token"]' 'content' 'CSRF-Token' Denial of Service Denial of service or DOS is a type of attack where attackers tried to bring down the service or make it inaccessible to users by disrupting the system. The attacker generally flooded the systems with lots of traffic or requests which in turn increases the CPU and memory load leading to a system crash. To mitigate DOS attacks in your Node.js application, the first step would be the identification of such an event. I highly recommend these two modules to be integrated into the system. Account lockout - After n number of failed attempts, lock the account or IP address for a period of time (say 24h?) Rate limiting - Limit the users to request the system n number of times within a specific period, for example, 3 requests per minute from an individual user The Regular expression Denial of service attack (ReDOS)is a type of DOS attack where the attacker exploits the regular expression implementation in the system. Some regular expression takes heavy computing power to execute and the attacker can exploit it by submitting requests that involve regular expression in the system which in turns increases the load on the system leading to system failure. You can use software like to detect dangerous regular expression and avoid to use them in your system. this We all use tons of dependencies in our projects. We need to check and validate these dependencies as well to ensure the security of the overall project. NPM already has an audit feature to find the vulnerability of the project. Just run the command shown below in your source code directory. npm audit To fix the vulnerability, you can run this command. npm audit fix You can also run the dry run to check the fix before applying it to your project. npm audit fix --dry-run --json HTTP Security Headers HTTP provides several security headers that can prevent commonly known attacks. If you are using the Express framework then you can use a module called to enable all security headers with a single line of code. Here is how to use it. This enables the following HTTP headers. helmet npm install helmet --save const express = require("express"); const helmet = require("helmet");  const app = express(); app.use(helmet());  //... Strict-Transport-Security X-frame-Options X-XSS-Protection X-Content-Type-Protection Content-Security-Policy Cache-Control Expect-CT Disable X-Powered-By These headers prevent malicious users from various types of attacks such as clickjacking, cross-site scripting, etc. Also published at https://codeforgeek.com/a-guide-to-securing-node-js-applications/

Security Best Practices for Node.js Apps

Tony Spiro is the Co-Founder of , an API-first for building content-powered apps. Cosmic JS Content Management Platform In this tutorial I’m going to show you how to build a user management app using Node.js and the . Cosmic JS CMS API TL;DR View the full source code on GitHub View the Demo The app will include the following pages: Login Signup Users list (logged in user access only) Getting Started Create a file titled app-server.js file and add the following: // app-server.jsimport express from 'express'import hogan from 'hogan-express'import http_module from 'http'import bodyParser from 'body-parser'import compression from 'compression'import session from 'express-session'import config from './config'import cors from 'cors'const app = express()app.use(cors({credentials: true, origin: true}))app.use(bodyParser.json())app.use(compression())app.engine('html', hogan)app.set('views', __dirname + '/views')app.set('port', process.env.PORT || 3000)app.use(express.static(__dirname + '/public'))app.set('trust proxy', 1) // trust first proxyapp.use(session({  secret: 'keyboard cat',  resave: false,  saveUninitialized: true}))app.use((req, res, next) => {  if (req.url === '/favicon.ico')    return res.end()  // Set global variables  res.locals.year = new Date().getFullYear()  // Set dev  if (process.env.NODE_ENV === 'development')    res.locals.is_dev = true  next()})const partials = {  header: 'partials/header',  footer: 'partials/footer'}require('./routes')(app, config, partials)const http = http_module.Server(app)http.listen(app.get('port'), () => {  console.info('==> 🌎  Go to http://localhost:%s', app.get('port'));}) This is the entry point of our app and serves to initialize everything we need for our user management app. We’re using Express for the Node.js framework, Hogan Express for view rendering from Mustache templates. Express Session is used to initialize and save sessions. We are going to have a couple partials available in our templates, header and footer as all of our pages will share these. Know Your Routes Next let’s take a look at index.js in our routes folder. // Routesmodule.exports = (app, config, partials) => {  require('./home')(app, config, partials)  require('./signup')(app, config, partials)  require('./users')(app, config, partials)  require('./auth')(app, config, partials)  require('./logout')(app, config, partials)  require('./404')(app, config, partials)} Here we have all of our routes. Logging In Let’s take a look at home.js which is the login page for our app: // home.jsimport Cosmic from 'cosmicjs'module.exports = (app, config, partials) => {  app.get('/', (req, res) => {    Cosmic.getObjects({ bucket: { slug: config.COSMIC_BUCKET } }, (err, response) => {      res.locals.cosmic = response      if (req.query.message === 'unauthorized')        res.locals.unauthorized_message = true      return res.render('index.html', {        partials      })    })  })} There is not much going on here, just loading our dynamic content from Cosmic JS, as well as the HTML login form. Looking at the auth.js file, you’ll see this is where the login form will send the data to log the user in. // auth.jsimport Cosmic from 'cosmicjs'import async from 'async'import _ from 'lodash'import bcrypt from 'bcrypt'const saltRounds = 10module.exports = (app, config, partials) => {  // Submit form  app.post('/auth', (req, res) => {    const data = req.body    Cosmic.getObjectType({ bucket: { slug: config.COSMIC_BUCKET } }, { type_slug: 'users' }, (err, response) => {      if (err)        res.status(500).json({ status: 'error', data: response })      else {        async.eachSeries(response.objects.all, (user, eachCallback) => {          if (!_.find(user.metafields, { key: 'email', value: data.email.trim().toLowerCase() }))            return eachCallback()          const stored_password = _.find(user.metafields, { key: 'password' }).value          bcrypt.compare(data.password, stored_password, function(err, correct) {            if(correct)              res.locals.user_found = user            eachCallback()          })        }, () => {          if (res.locals.user_found) {            req.session.user = {              first_name: res.locals.user_found.metafield.first_name.value,              last_name: res.locals.user_found.metafield.last_name.value,              email: res.locals.user_found.metafield.email.value            }            req.session.save()            return res.json({ status: 'success', data: response })          }          return res.status(404).json({ status: 'error', message: 'This user was not found or the email and password are incorrect.' })        })      }    })  })} When the data is sent to /auth the Cosmic NPM module searches for the email first then, if found tries to match the submitted password to the password saved in the Cosmic JS API (using ). If both email and password are matched with a user, the session is created and the user is redirected from the login page to the users page. Let’s take a look at the users list page. bcrypt Access Exclusive Content After the user has logged in successfully, they are redirected to the users list page. This is how it looks: app.get('/users', (req, res) => {  if(!req.session.user)    return res.redirect('/?message=unauthorized')  res.locals.user = req.session.user  async.series([    callback => {      Cosmic.getObjectType({ bucket: { slug: config.COSMIC_BUCKET } }, { type_slug: 'users' }, (err, response) => {        res.locals.users = response.objects.all        callback()      })    },    callback => {      Cosmic.getObjects({ bucket: { slug: config.COSMIC_BUCKET } }, (err, response) => {        res.locals.cosmic = response        return res.render('users.html', {          partials        })      })    }  ])}) If the user session is not set, they are immediately redirected to the login page with an unauthorized message. If they have a user session, they will be able to see a list of all registered users (from the Users Object Type). This gives you the idea of how to limit user access in our app. By checking for req.session.user on any page, you can restrict access to logged in users only. Signing Up Let’s take a look at what happens for new users when they post their info to /users: app.post('/users', (req, res) => {  const data = req.body  async.series([    callback => {      let user_found = false      Cosmic.getObjectType({ bucket: { slug: config.COSMIC_BUCKET } }, { type_slug: 'users' }, (err, response) => {        _.forEach(response.objects.all, user => {          if (_.find(user.metafields, { key: 'email', value: data.email.trim() }))            user_found = true        })        if (!user_found)          return callback()        // User found        return res.status(409).json({ status: 'error', message: 'Email already in use' })      })    },    callback => {      bcrypt.hash(data.password, saltRounds, function(err, hash) {        res.locals.hash = hash        callback()      })    },    callback => {      // Send to Cosmic      const object = {        type_slug: 'users',        title: data.full_name,        metafields: [          {            title: 'First name',            key: 'first_name',            type: 'text',            value: data.first_name          },          {            title: 'Last name',            key: 'last_name',            type: 'text',            value: data.last_name          },          {            title: 'Password',            key: 'password',            type: 'text',            value: res.locals.hash          },          {            title: 'Email',            key: 'email',            type: 'text',            value: data.email.trim().toLowerCase()          }        ]      }      if (config.COSMIC_WRITE_KEY)        object.write_key = config.COSMIC_WRITE_KEY      Cosmic.addObject({ bucket: { slug: config.COSMIC_BUCKET } }, object, (err, response) => {        if (err)          res.status(500).json({ status: 'error', data: response })        else          res.json({ status: 'success', data: response })        res.end()      })    }  ])}) There’s a few things happening here. First, the email is checked against the current list of users. If a match is not found, the user object is created with each data point of the user: First Name, Last Name, Email and Password stored as metafields in the Cosmic JS API. Taking this a step further, after you log into your Cosmic JS bucket and go to your Users Object Type you will be able to add more Metafields to the users in your system. This makes adding dynamic, extended data very easy. For example, let’s say you needed to add a profile image, address, GitHub username, etc. All of these can be added as Metafields to the User Object. See screenshot below: See Ya Next Time Now let’s see what happens when a user accesses the /logout route: // logout.jsmodule.exports = (app, config, partials) => {  app.get('/logout', (req, res) => {    req.session.destroy()    return res.redirect('/')  })} The session is simply destroyed and the user is redirected back to the login page. Where’s the HTML? I’m not going to go into too much detail on the HTML, but basically both login and signup forms have JQuery validation and submit AJAX requests to the route endpoints. to see how JQuery is used for this and other UI and UX things. Check out the main.js file on GitHub Conclusion And that’s it. Cosmic JS is a powerful platform for content creation and app data management. With your Cosmic JS-powered User Management App you can now extend your user data using the Cosmic JS API or from your Cosmic JS Bucket Dashboard. I hope you found this tutorial helpful. If you have any questions or feedback you can or . reach out to us on Twitter chat with us in the Slack community

Stories, News & Mentions about SKALTRO

Skaltro’s Stories on HackerNoon