Scribd
Upload
66 views17 pages

Node.js Security Best Practices Guide

The document discusses security best practices for web applications built with Node.js. It provides an overview of Node.js and its features. It then discusses OWASP Node Goat, an intentionally insecure Node.js app used to demonstrate vulnerabilities. Main libraries like Express and MongoDB are explained. The OWASP Top 10 security risks are covered in detail, along with recommendations to address each one when developing Node.js apps. These include using encryption, access control, CSRF protection, and keeping dependencies up to date. Scanning for vulnerabilities with tools like nsp is advised.

Uploaded by

Dejan Mitic
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
66 views17 pages

Node.js Security Best Practices Guide

The document discusses security best practices for web applications built with Node.js. It provides an overview of Node.js and its features. It then discusses OWASP Node Goat, an intentionally insecure Node.js app used to demonstrate vulnerabilities. Main libraries like Express and MongoDB are explained. The OWASP Top 10 security risks are covered in detail, along with recommendations to address each one when developing Node.js apps. These include using encryption, access control, CSRF protection, and keeping dependencies up to date. Scanning for vulnerabilities with tools like nsp is advised.

Uploaded by

Dejan Mitic
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
  • Introduction to Node.js Security
  • Node.js Overview
  • OWASP Node Goat
  • Main Libraries Used in Node Goat
  • OWASP Top 10
  • Conclusion
  • Questions & Discussion

Phillip Chaffee

July 7th, 2015

[Link] Security
Security for web servers written in Javascript
[Link] Overview

 Javascript interpreter for writing servers


 Built on Google Chrome’s Javascript Runtime – V8
 Event driven
 Non-blocking I/O model
 Written in C
OWASP Node Goat

What is it? How to use it

 Node Goat is a  Either


purposefully flawed  Fork and deploy (Heroku)
application developed  Fork, clone, and run locally
using [Link].
 Open the source code
 Made to be hacked/fixed
to learn the OWASP top 10  Follow the walkthrough
for [Link].
 Source code comments
are very helpful
Main Libraries Used in Node Goat

 ExpressJS
 [Link] framework
 Node is very low level
 Needs a framework to sit on top of it to handle routing

 MongoDB
 A NoSQL database that uses a Javascript console
 Stores data in JSON objects

 Swig
 A front end framework for injecting Javascript into the browser
OWASP Top 10
A1 - Injection
A2 – Broken Auth

 Password field needs encryptions


 NPM to the rescue
 Bcrypt
A3 - XSS

 Not much different then in a non [Link] app


 Validate all inputs
 Use correct output encoding
 HTTP only on session cookies not needed by JS
 Use built in Express middleware session management
 [Link]([Link]({});
A4 – Insecure Direct Object References

 Use session instead of request parameters


 Also
 Check access
 Use indirect session/user object references
A5 - Misconfiguration

 [Link] configurations tips


 Use the latest and most stable versions of [Link] and all major
packages being used
 Lock all npm packages versions
 Use HTTP request body limiting middleware
 Never run an application with root privileges

 Helmet
 Helmet is a great node package that bundles together a lot of the
security configuration you will need
A6 – Sensitive Data

 Use secure HTTPS protocol


 [Link]()

 Encrypt all sensitive data


 var crypto = require(“crypto”);

 Don’t store sensitive data longer than you need to


 Verify algorithms strength
 Disable autocomplete
A7 – Mission Function Level Access Control

 Verifythat the current user has sufficient rights to view


restricted areas
 ExpressJS middleware
A8 – Cross-Site Request Forgery

 Malicious web pages


 ExpressJS provides middleware specifically for this
 [Link]([Link]());
 [Link](function(req, res, next) {
 [Link] = [Link]();
 next();
 });
A9 - Using Components with Known
Vulnerabilities

 Do not run any modules with root privileges


 Use the Node Security Project
 npm install nsp –g
 Nsp package

 This
scans the [Link] file and alerts you to any
packages with known vulnerabilities
A10-Unvalidated Redirects and Forwards

 Avoid using redirects and forwards altogether


 If used, don’t include user parameters
 Otherwise, validate destination and current user
Conclusion

 ZAProxy still works great for testing


 It has it’s own npm package
 npm install zaproxy
 var options = { proxy : ‘[Link] };
 var ZapClient = require(‘zaproxy’);
 var zaproxy = new ZapClient(options);

 [Link] very low level, so security can be built as


middleware
 Further reading/information
 [Link]
security/blob/master/[Link]
Questions & Discussion

Phillip Chaffee July 7th, 2015 Security for web servers written in Javascript Node.js Security
Javascript interpreter for writing servers Built on Google Chrome’s Javascript Runtime – V8 Event driven Non-blocking I/O
Either Fork and deploy (Heroku) Fork, clone, and run locally Open the source code Follow the walkthrough Source code c
ExpressJS Node.js framework Node is very low level Needs a framework to sit on top of it to handle routing MongoDB A N
OWASP Top 10
A1 - Injection
A2 – Broken Auth Password field needs encryptions NPM to the rescue Bcrypt
Not much different then in a non Node.js app Validate all inputs Use correct output encoding HTTP only on session cookies
A4 – Insecure Direct Object References Use session instead of request parameters Also Check access Use indirect session/u
Node.js configurations tips Use the latest and most stable versions of node.js and all major packages being used Lock all

You might also like