Node.JS security
-
Upload
deepu-s-nath -
Category
Technology
-
view
461 -
download
3
Transcript of Node.JS security
Node Security
By
Rejah Rehim
Know what you require ();
NPM has ~75000 modules
Use good Security Defaults
Node is a set of barebons modules
Express is a barebons framework
Lusca
App security module for express
var express = require('express'),
app = express(),
lusca = require('lusca');
With Express Middleware
● app.use(lusca.csrf());● app.use(lusca.csp({ /* ... */}));● app.use(lusca.xframe('SAMEORIGIN'));● app.use(lusca.p3p('ABCDEF'));● app.use(lusca.hsts({ maxAge: 31536000 }));● app.use(lusca.xssProtection(true));
CSRF
Trick victim's browser into making malicious requests
Lusca.csrf()
Uses Token Synchronizer pattern
1) Create a random token on serverside
2) Add token to res.local
3) Dump that token in app page
4) Sends with every PUT DELETE POST request
5) Verify token is correct, Else return 403
CSP
● Content Security Policy ● Basically a white listing
Lusca.csp()
app.use(lusca.csp({
policy: {
'default-src': 'none',
'script-src': '\'self\' https://apis.google.com'
},
reportUri: '/report-violation'
}));
Lusca.hsts()
● Ensures HTTPS traffic● Prevent MITM
Lusca.xframe()
● Prevent Others from loading your app in Iframe
HTTPOnly Cookies
● Prevent Session Hijacking
app.use(express.session({ secret: 'My super session secret', cookie: { httpOnly: true, secure: true }}));
Eval is evil
Node Security Project
● Audit all modules in NPM● Contribute patches● Educate others
Scan For vulnerable modules
npm install grunt-nsp-package --save-dev
grunt validate-package
Update your dependency
Clientside modules
Escape everithing
● Not just user inputs Backend bata as well
Underscore templates
<% %> - to execute some code
<%= %> - to print some value in template
<%- %> - to print some values with HTML escaped
Know your templating library
● Use it properly
Update your front-end dependencies
● Retire.js
npm install grunt-retire --save-dev
grunt retire
Let's Recap
● Know what you're require()'ing● Node is stil a Javascript● Use good security defaults● Update your dependencies – use automation
Thanks