OWasp NodeJS Security Cheat Sheet Flashcards
Real time AJAX security evaluation for learners based on content at https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet
Use Flat Promise Chains
What problem does excessive nesting in asynchronous callbacks cause?
It leads to a “Pyramid of Doom” or “Callback Hell,” making code harder to maintain and track errors or results.
Use Flat Promise Chains
How do Promises help avoid “Callback Hell”?
Promises provide a top-down execution flow and automatically skip to the first .catch function when an error occurs, simplifying error handling.
Use Flat Promise Chains
What approach should be used to further reduce complexity in Promises?
Use flat Promise chains to maintain readability and avoid nested structures.
Use Flat Promise Chains
How can nested callbacks be rewritten using a flat Promise chain?
Example:
```javascript
func1(“input1”)
.then(result => func2(“input2”))
.then(result => func3(“input3”))
.then(result => func4(“input4”))
.catch(error => {
// error handling
});
~~~
Use Flat Promise Chains
How can nested callbacks be avoided using async/await?
Example:
```javascript
(async () => {
try {
const res1 = await func1(“input1”);
const res2 = await func2(“input2”);
const res3 = await func3(“input3”);
const res4 = await func4(“input4”);
} catch (err) {
// error handling
}
})();
~~~
Best Practices
What are best practices for using Promises?
Use Promises for asynchronous code instead of deeply nested callbacks.
Convert non-Promise-based modules using Promise.promisifyAll() if needed.
Use async/await for further simplification and readability.
Set Request Size Limits
Why should request size limits be set?
Without limits, attackers can send large request bodies, exhausting server memory or disk space.
Set Request Size Limits
How can request size limits be set for all requests?
Using the raw-body package in Express with a specified limit:
```javascript
getRawBody(req, { length: req.headers[‘content-length’], limit: ‘1kb’ }, callback);
~~~
Set Request Size Limits
Why should limits differ by content type?
JSON payloads are blocking operations and riskier than multipart inputs; setting appropriate limits per type prevents performance issues.
Set Request Size Limits
How can Express middleware enforce content-specific limits?
Example:
```javascript
app.use(express.urlencoded({ extended: true, limit: ‘1kb’ }));
app.use(express.json({ limit: ‘1kb’ }));
~~~
Set Request Size Limits
How should Content-Type headers be handled to prevent bypassing limits?
Validate request data against the stated Content-Type header and prioritize checking large requests or specific types.
Do Not Block the Event Loop
What architecture does Node.js use?
A single-thread, non-blocking, event-driven architecture.
Do Not Block the Event Loop
What happens during CPU-intensive JavaScript operations?
The event loop becomes blocked, waiting for the operation to finish.
Do Not Block the Event Loop
Why are asynchronous operations important in Node.js?
They allow the main application to remain unblocked, improving performance.
Avoiding Race Conditions
What issue arises when synchronous code depends on asynchronous callbacks?
Race conditions, where operations may execute out of order, leading to potential errors or security issues.
Avoiding Race Conditions
How can race conditions be avoided?
Ensure dependent operations are written within the same callback or non-blocking function:
```javascript
fs.readFile(‘/file.txt’, (err, data) => {
// perform actions
fs.unlink(‘/file.txt’, (err) => { if (err) throw err; });
});
~~~
Input Validation
Why is input validation essential for application security?
To prevent various attacks like SQL Injection, XSS, Command Injection, Denial of Service, Directory Traversal, and more.
Input Validation
What is the best input validation technique?
Use an allow-list of accepted inputs.
Input Validation
What should be done if an allow-list cannot be used?
Validate inputs against expected schemes and escape dangerous inputs.
Input Validation
Which Node.js modules simplify input validation?
validator and express-mongo-sanitize.
Input Validation
Why is JavaScript parsing of URLs a challenge for input validation?
The dynamic nature of JavaScript allows query strings to take on various forms, which can lead to inconsistencies.
Output Escaping
Why is output escaping important?
To prevent Cross-Site Scripting (XSS) attacks by sanitizing HTML and JavaScript content shown to users.
Output Escaping
Which libraries can be used for output escaping in Node.js?
escape-html and node-esapi.
Activity Logging
Why is logging application activity a good practice?
It aids in debugging, enhances security through incident response, and supports IDS/IPS tools.