Node.js Security and Architecture

Question 1

What is OWASP?

Answer 1

Open Web Application Security Project.

It’s a useful resource for threat prevention advice

Question 2

Name the three security risks that we studies that are applicable to node.js

Answer 2

Code Injection

Cross Site Scripting (XSS)

Malicious Packages

Question 3

What is Code Injection?

Answer 3

Inserting (‘injecting’) data into an application, which is then interpreted as a command

A SERVER SIDE vulnrability

Question 4

How do you protect against Code Injection?

Answer 4

Validating Data - ensuring that the data you have received is of the correct type (eg expecting a String but receiving a JS object)

Question 5

What is XSS?

Answer 5

Cross Site Scripting

A specific type of injection attack - a CLIENT SIDE vulnerability

An attacker submits untrusted data, which the browser then re-displays. It could seem legitimate (eg a facebook post or fake listing on a shopping site), which tricks users into trusting it and passing the code. Code is then passed back to the user in a way that causes the browser to parse the code as if it were part of the application.

Question 6

How do you protect against XSS?

Answer 6

Sanitising Input - check whether the input matches the expectation

Never print input from a user to a HTML page without sanitising it (removing undesirable parts of the code)

Use a trusted library to do this

Question 7

What is a Malicious Package?

Answer 7

Packages downloaded from npm that do not do what they day they do, or are malicious copies of legitimate packages

Question 8

Why are Malicious Packages dangerous?

Answer 8

When installing from npm, you:

• execute code from someone else
• expose users to code not written by you, often for code that hasn’t been written yet (libraries get updated)

By allowing others to run code on your machine with user privileges, you are giving them a lot of power

Question 9

How do you protect against malicious packages?

Answer 9

Check npm trust indicators

Lock down the package version when downloading

Check for typos when installing

Question 10

What is ODM?

Answer 10

Object Document Mapping

Maps documents in a database to objects in the code
- exists for document-oriented databases

Provides abstraction for the basic CRUD methods and other operations on documents

Question 11

What does using ODM mean in practice?

Answer 11

You can write code in your app’s naive language (eg JS)

If used properly, ODM will take care of object persistance

Question 12

How does ODM help to achieve a three-tier architecture?

Answer 12

It abstracts away the details of database calls