HOW TO MAKE YOUR NODEJS APPLICATION SECURE (24 BEST SECURITY TIPS ) www.bacancytechnology.com
Today, I have brought you a collection from my pandora box. Node.js is the most favorite app framework of my friends, and I cannot wait but help my friends with these security best practices for their Node.js applications. By far now, there are 200,214 websites, and 93,087 unique domains are using Node.js, and it is the most popular technology for web app development in the USA. Famous brands like Netflix, eBay, Reddit, LinkedIn, Tumblr, PayPal, and more are using Node.js. There are these Top 7 Reasons to choose Node.js for Web Application Developmentin 2020. And before you march ahead with building your next enterprise application with Node.js, hop on to know how you can protect your Node.js application. For the start-ups that are already using Node.js in their web application, even you can implement the following security tips to keep your app free from attacks. In this blog post, I have also covered the top OWASP (Open Web Security Project) injection threats.
Today, I have brought you a collection from my pandora box. Node.js is the most favorite app framework of my friends, and I cannot wait but help my friends with these security best practices for their Node.js applications. By far now, there are 200,214 websites, and 93,087 unique domains are using Node.js, and it is the most popular technology for web app development in the USA. Famous brands like Netflix, eBay, Reddit, LinkedIn, Tumblr, PayPal, and more are using Node.js. There are these Top 7 Reasons to choose Node.js for Web Application Developmentin 2020. And before you march ahead with building your next enterprise application with Node.js, hop on to know how you can protect your Node.js application. For the start-ups that are already using Node.js in their web application, even you can implement the following security tips to keep your app free from attacks. In this blog post, I have also covered the top OWASP (Open Web Security Project) injection threats.
1. Use Linter Security While you are developing a Node.js application, you may have invoked a child process, might have used eval or imported a module with a non-string literal. By following such unintentional steps, your project might be facing vulnerabilities. We advise you to use linting, which ensures that you eliminate potentially dangerous patterns in your code. You can use the linter plugins like eslint-plugin-security to catch threats and vulnerabilities while you are coding your node.js application.
2. Apply rare limiting on the middleware Your application is under the threat of a DOS attack where authenticate users may not get the requested service or get degraded service. To overcome such a situation, you should implement rare limiting using middleware for smaller and less-critical apps. For comparatively larger apps, you can use rate-limiter-flexible package, Nginx, cloud firewalls, or cloud load balancers.
3. Secret Management You must not save your secrets in configuration files or source code. Unknowingly you may keep private repositories publicly, where you unveil all your secrets. This way, anyone can access your APIs, database, services, and more.
Thus, you must use Kubernetes/ Docker secrets, Vault products, or environment variables. In this manner, your secrets are safe, encrypted, and managed. Pro Tip: Use pre-commits and push hooks to avoid accidental secrets.
4. Preventing Query Injections Many developers use JS strings or string concatenations to insert values into queries. However, this practice makes your data unvalidated, and your app highly vulnerable to SQL/NoSQL injection attacks. Sequelize, KnexKnex, and mongoosemongoose, these node.js libraries have in-built protection against such SQL injection threats. To prevent these malicious attacks, you must always use Object-Relational Mapping/ Object Document Mapper ORM/ODM or database libraries that support indexed parametrized queries.
5. Evade DOS attacks by setting the system crash When the Node process cannot handle some errors, the entire process crashes. Even a few best practices suggest exiting the process despite catching the mistake. All this struggle because the attackers get an easy spot that is vulnerable by the input, and crashes the system with repeated faulty inputs. Though there is no solution to this adversity, you can validate the input and spare the process of crashing on invalid user input. You can wrap all the incoming routes with a catch and ensure that your system doesn’t crash on error requests.
6. Regulate the HTTP headers Use secure headers to combat cross-site scripting (XSS), clickjacking, and other malicious attacks that lead to massive security vulnerabilities. You can use modules like the helmet that is easily configurable.
7. Examine for vulnerable dependencies The NPM ecosystem of Node makes it common to have many dependencies for a project. You must always check your dependencies and use tools like nsp or snyk, and npm audit, to track, monitor, and patch vulnerabilities. You can catch a dependency before it makes its way to execution by aligning these tools with CI setup.
8. Use Bcrypt instead of Crypto Save your API passwords or secrets using Bcrypt, which is a secure hash + salt function. Without implementing this function, your passwords or secrets are vulnerable to brute force and dictionary attacks. As you use the Bcrypt function, you specify the number of rounds, which is the number of times the data works, and so it is more securely and forcefully hashed.
9. Escape Output Many a time, your browser executes the user-sent input, and this is known as Cross-site scripting (XSS) attack. You can use encoding, escaping, or dedicated libraries that mark data as pure content and do not allow it to execute. Hence, you must escape output like HTML, JS, and CSS output, or else, the attackers would store malicious code in your DB, which in turn will pass over to needy clients.
10. Validate incoming JSON schemas The attacker may keep trying to find the various input combinations that crash your application. So, don’t be generous and permissive of such experiments and trials. You should lay validation on incoming requests’ body payload and check if it meets your expectations.
Jsonschema or joi are lightweight JSON-based validation schemas that you can use to keep away from the coding struggle.
11. Backlisting JWTs Your Node.js app considers JSON Web Tokens (JWT) issued by you as authentic, which makes you accessible to the app data using these tokens. However, in the case of misplaced or stolen tokens, there is no way that you can stop an attacker from accessing your application. For eg., when you use JWT with Passport.js. Hence, you must validate your untrusted tokens that are expired or misplaced.
12. Prevent Brute-force attacks against the authorization A hacker can try to breach into your application by trying too many attempts to enter username and password. You can prevent such brute-force attacks by implementing rate limiting authorization by restricting a particular IP to login to your app.
For eg., when you find consecutive failed attempts of authorization of the same username and a unique IP, restrict it further. Or when there are several failed attempts of permission for an extended period, like 100 failed attempts by a particular IP on the same day.
13. Run Node.js as a non-root user A user process generally has the least access to the system information and resources. However, with the root access, an attacker can attain the maximum power of the local machine and can reroute traffic to other servers. By default, Node.js runs as a non-root user with unlimited access, which is vulnerable. Thus, you must use a non-root user or bake it into a Docker image.
14. Limit payload size As your Node.js app receives larger requests, it has difficulty processing other important work, which leads to lower app performance and exposes your app to DOS attacks. For large claims, a bigger body payload is under execution by a single thread. Attackers can pose a threat even without multiple requests, because of the bigger payload size. You can use express body-parser for limiting the body-size by accepting only small-size payloads.
15. Sidescape the javascript eval statement A considerable performance concern arises because the eval statement permits to execute a custom JS code while running the app. Now, a user may input a malicious JS code, which leads to a security issue. By the use of eval function, or the new Function, setTimeout, and setInterval, susceptible text gains access to the Javascript of the page through the input. Hence, you should use such functions cautiously.
16. Counter malicious RegEx All javascript apps are vulnerable to regular expressions, and specifically the Node.js apps. They cost a large amount of CPU power as the user inputs text to match. Sometimes you may block the entire event loop due to poorly written RegEx. For eg., the moment package destroyed in Nov 2017. You should use safe-regex to find out which of your regular expressions are posing a threat or use validator.js package.
17. Safe module loading Keep a check on what your Node.js program is importing or requiring. Many times, the fs.readFile() parameters come from the user input, which can be a malicious act. The impact of such results can access your sensitive resource or breach into other existing file systems. You should use the linter Eslint-pluginsecurity to catch such vulnerable user attempts.
18. Run unsafe code in a Sandbox Make sure that you use a sandbox tool when your application runs an external code because that can attack your system with infinite loops, overloading memory, or accessing sensitive env variables. You must use dedicated processes like cluster.fork(), or npm packages, or a serverless environment as a sandbox to protect your Node.js application.
19. Be cautious when working with child processes Try not to use child processes, and when you have to, do validate the inputs. They can pose shell injection attacks by unsanitized system commands. Instead, you can use child_process.execFile, which executes a single command with multiple attributes, and thus will not expand shell parameters.
20. Hide error details from clients Good advice says you should use your own error handler that has custom error objects. While doing that, you must not return the entire error object to the user because it might obtain some of your application’s sensitive data.
21. Configure 2FA for NPM or Yarn Hackers steal the developers’ credentials and instill malicious code in your project libraries, despite your applying multi-factor authentication (MFA). If the attackers plant the code on the public domain, then the entire web may be infected. Hence, you must use two-factor authentication 2FA with npm/yarn, which leaves no chance of hackers.
22. Cookie & Session security You should not reveal your tech-stack because attackers know the weakness of all the frameworks and technologies. Mostly cookies are transmitted over insecure connections, and hackers can tweak the session for the private information. You must protect your app as well as your user’s privacy by keeping a check on Cookie and Session security.
23. Prevent unsafe redirects As the attackers get to know that you are not validating user input, they can pose attacks like credential stealing, can launch phishing attacks or other malicious events. Thus, you must take care of all the redirects that arise from your application. If you take this matter lightly, attackers can post specific links of forums, or social-media attractions, so that your users click through it.
24. Avoid publishing secrets You must see that all your passwords, API keys, and other secrets are safe and not published on the public NPM registries. If not so, attackers can leverage the benefits of your leaks and impede your financial losses, can impersonate you, and other risks too. You can use .npmignore file as a blacklist, and files array in package.json as a whitelist.
Conclusion Node.js is the master key solution for start-ups to hastily simplify development and it is a sophisticated ecosystem adopted by the leading enterprises. Even the safest of all treasures need to be precautious of theft and attacks. And when you are using the most precious web framework for your valuable project, you sure want to shield it from burglary. Get in touch with our Node.js experts and protect your system from unauthorized breaches. Hire Node.js Developer and Consultant to build data-intensive apps tailored to meet your business needs.
Thank you