8758. Express Security - Draft
Express

Introduce how to build secure web application with express.

throw error

fs.readFile("myfile.txt", function(err, data) {
  if (err) {
    console.error(err);
    throw err;
  }
  console.log(data);
});

Parse query strings

//http://mysearchengine.com/search?q=crockford+backflip+video
app.get("/search", function(req, res) {
  var search = req.query.q.replace(/\+/g, " ");
  // … do something with the search …
});
 
//http://mysearchengine.com/search?crockford+backflip+video, no q
app.get("/search", function(req, res) {
  var search = req.query.q || "";
  var terms = search.split("+");
  // … do something with the search …
});
 
//http://mysearchengine.com/search?q=abc&q=xyz, two q parameters
var arrayWrap = require("arraywrap");
// …
app.get("/search", function(req, res) {
  var search = arrayWrap(req.query.q || "");
  var terms = search[0].split("+");
  // … do something with the terms …
});

SSL, HTTPS express-enforces-ssl FORCE USERS TO HTTPS

var enforceSSL = require("express-enforces-ssl");
// …
app.enable("trust proxy");
app.use(enforceSSL());

KEEP USERS ON HTTPS HTTP Strict Transport Security (HSTS) Strict-Transport-Security: max-age=31536000 https://github.com/helmetjs/helmet

cross-site scripting (XSS) attack ESCAPING USER INPUT

Hello, <script src="http://evil.com/hack.js"></script>world.
Hello, &lt;script src="http://evil.com/hack.js"&gt;&lt;/script&gt;world.

set the X-XSS-Protection header app.use(helmet.xssFilter());

PROTECTING AGAINST CSRF IN EXPRESS https://github.com/expressjs/csurf

var csrf = require("csurf");
// …
app.use(csrf());
app.get("/", function(req, res) {
  res.render("myview", {
    csrfToken: req.csrfToken()
  });
});

server render

<form method="post" action="/submit">
<input name="_csrf" value="<%= csrfToken %>" type="hidden">
...
</form>

Keeping your dependencies up to date find out which versions were out of date: npm outdated

Node Security Project https://nodesecurity.io/advisories

npm install –g nsp nsp audit-package

Handling server crashes, forever

npm install forever --save

"scripts": {
"start": "forever app.js"
}

Various little tricks app.disable(“x-powered-by”);

X-Frame-Options

app.use(helmet.frameguard("sameorigin"));
// or …
app.use(helmet.frameguard("deny"));

restrictive crossdomain.xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="none">
</cross-domain-policy>
app.use(helmet.noSniff());

5. Reference