Essential Node.js Security for Express Web Applications

✍ Scribed by Liran Tal

• Publisher: Leanpub
• Year: 2023
• Tongue: English
• Leaves: 140
• Category: Library

✦ Synopsis

Serverless is taking the cloud native world by storm. This new approach promises extraordinary value, from increased developer productivity to dramatic cost savings. In some aspects, serverless also boasts significant security advantages compared to the server model. But as this practical report explains, securing serverless still requires diligence from the developers and application security professionals involved in the process.

Guy Podjarny and Liran Tal from Snyk examine the significant benefits that serverless brings to application security, as well as the considerable risks involved when you configure a serverless system. You’ll also learn a platform-agnostic security model known as CLAD that will help you address Code vulnerabilities, Library vulnerabilities, Access and permissions, and Data security.

This report helps you:

Understand what serverless is and how this model evolved from cloud native processes
Explore the three primary areas where serverless improves security
Learn how the CLAD model provides four categories to help you home in on specific security issues
Follow a detailed example that demonstrates how poor security manifests in real-world serverless applications

✦ Table of Contents

Table of Contents
Foreword
About The Author
Liran Tal
About The Reviewers
Danny Grander
Tim Kadlec
Cody B. Daig
Zach Sosana
About The Book
Requirements
Source Code
HTTP Headers Security
Security Headers Caveats
Node.js Packages for HTTP Security Headers
Strict Transport Security
X-Frame-Options
Content-Security-Policy
Other HTTP headers
Summary
Secure Session Management
Session Security Risks
Session Security in Node.js and ExpressJS
Summary
Hardening ExpressJS
Security Through Obscurity
Brute-Force Protection
Advanced Functionality Limiting
body-parser middleware
Summary
Cross-Site Request Forgery (CSRF)
The Risk
The Solution
Summary
Cross-Site Scripting (XSS)
The Risk
The Solution
Summary
Secure Code Guidelines
Node.js Releases and APIs
Input Validation
Output Encoding
Regular Expressions
Strict Mode and Eval
Cryptographic Practices
User Process Privileges
Summary
Injection Flaws
NoSQL Injections
NoSQL SSJS Injections
Blind NoSQL Injections
OS Command Injection
Summary
Secure Dependency Management
Evaluating Dependencies
Dependency Tracking
NPM Shrinkwrap
Yarn as npm Package Management
Summary