As we are advancing into a more digital era, the most valuable article has become ‘information’ and security.
The primary concern of users whenever they access a new website or a service is that their data will remain secured and will not go into the wrong hands under any circumstances.
But when was the last time you looked at the security concerns for your web application?
Often web developers when starting a comparatively small project which they wish to take to a larger scale overlook the vulnerabilities their web applications have in a race to make the website more optimized in terms of visual appearance and performance.
But in reality, they are exposing their applications to hawk-eyed cybercriminals who keep looking for security vulnerabilities like these and can also pave a way for not only their application getting hacked but also risking other parties dependent on their application.
It is henceforth essential to ensure that you are following a structured manner to give your users a wholesome and secure experience.
In this blog, we will look at Top 10 security concerns for web applications according to OWASP and know how you can make your web applications created in Nodejs free from those concerns.
Table of Contents
What is OWASP?
OWASP or Open Web Application Security Project is a nonprofit foundation which has worked and is currently working to improvise the strategies one uses to ensure their applications and software remain secured.
Security Concern #1: Injection
Injection attacks occur when foreign commands or queries are run from your machine which gives access to data without being authorized to access it.
Examples of injection attacks include SQL, NoSQL, OS, LDAP, etc. Injection attacks occur due to improper form and data validation techniques.
To prevent your node.js application from injection attacks, make sure you are not executing any commands randomly.
Instead of exec function, use execFile function which will raise an error when an injection attack is being tried to run.
Next, you need to ensure that the input data is strictly validated and special characters are not exploited by the hackers. You can perform the execution of this validation all by yourself or you can utilise the shell-quote library which can be easily installed using npm package manager.
Security Concern #2: Broken Authentication
Authentication practices are often overlooked in the web applications. This causes the hackers to easily crack passwords and keys and exploit other vulnerabilities which can cause identity theft of your users or misuse their data entirely.
To prevent your node.js application from falling prey to broken authentication, you can ensure that the passwords your users need to keep are strong enough, the number of login attempts are limited, all the login IP addressed are logged, password recovery is secure, encrypt passwords to prevent rainbow tables attack and never expose the data of the user session on the client-side environment.
Security Concern #3: Sensitive Data Exposure
Sensitive data includes financial records, health records etc. Sometimes proper security isn’t implemented to protect this data from getting exposed which causes the hackers to commit a number of crimes and frauds. Extra encryption of such data is imperative for a developer to implement.
To prevent exposure of sensitive data on your node.js web application, ensure that all the user passwords are being encrypted by using strong hashing functions.
Enforce HTTP strict transport security (HSTS) to ensure that the data flow is occurring through completely secure channels.
Security Concern #4: XML External Entities
Evaluation of external entity references is done within XML documents by old processors. Given the fact that numerous websites exist having old XML configurations, this vulnerability can be exposed in large numbers.
These external entities can be used to gain access to internal entities using various methods like internal file shares and port scanning, remote code execution etc.
dbus is a npm package that has the vulnerability of XML external entities. While creating your web application ensure that this package is not included.
Security Concern #5: Broken Access Control
Broken access control is the security flaw where it is not specified how much your user will have access to the web application. Hackers use this vulnerability to gain access to users’ sensitive data and misuse or modify it.
Ensure that your APIs are secure. Account authorization can be tested with Auth zn test. Prevent basic vulnerabilities by using automated security test cases. Make sure both authentication and authorization are implemented correctly to prevent a user from logging into someone else’s account and stealing data.
Security Concern #6: Security Misconfiguration
Security misconfigurations are one of the most common security issues seen in web applications. This is due to the fact that often the configurations made to ensure security in the web application are incomplete, error messages contain sensitive information, cloud storage is open and accessible, etc. It is extremely crucial to carefully configure these security practices and keep updating them from time to time.
To prevent security misconfiguration, the developer, staging, and production levels should be made accessible with different keys, default package settings should be customized, and weak login credentials from the users’ end should not be accepted.
Security Concern #7: Cross Site Scripting
Cross-site scripting flaws occur when data is added to the webpage without proper validation and security checks. Usage of browser APIs that allow users to add data that gets converted into HTML and JavaScript can cause hackers to run malicious scripts and gain complete control of the website and/or redirect the users to unwanted websites.
To prevent cross-site scripting attacks, the developer needs to treat every incoming user data as a malicious attack and carefully scan and validate it before accepting it.
Security Concern #8: Insecure Deserialisation
Insecure deserialisation occurs when the logic of the code is tampered with by using untrusted data. The hackers can cause a DoS attack by exploiting this vulnerability.
To prevent attacks caused to insecure deserialisation, the developer needs to prevent cross-site request forgery (CSRF). It can easily be prevented by generating a CSRF token from the server where the web application resides and planting it inside a form field that is hidden at the client-side.
Security Concern #9: Using Components with Known Vulnerabilities
There are numerous libraries, frameworks, and packages which one just downloads without running a complete check. These could be malicious code written to penetrate into your application. It can cause severe loss of data.
To make your node.js application fully immune from these components, make sure you are running security checks every now and then. You can use White Source Bolt to keep track and prevent such vulnerabilities.
Security Concern #10: Insufficient Logging and Monitoring
It is imperative that your web application should internally log and monitor the activities being performed on your website so as to prevent the hackers from getting into your system and if they do, cause alerts and stop them from taking over your server as well as not cause harm to any other parties associated with your web application.
The utilisation of a logging system (Example: Logz) can be utilised to track all the changes and activity going on your web application and alert when any unusual activity is observed. The utilisation of monitoring tools (Example: Prometheus) can also prevent vulnerabilities due to insufficient monitoring on your web application.
Frequently Asked Questions
Read the article and carefully evaluate the methodologies you have incorporated in your web application and make sure that you have used the best security practices that will make your application free from all vulnerabilities.
Where there is a will, there is a way and where there is a technological tool, there is a scope of vulnerability. Although as a single entity, Nodejs is secure however when it is coupled with third party applications it becomes imperative to run a security check and make sure there are no loopholes left that can damage the security of your web application.
There are several npm packages which can be considered or deliberately made malicious which can attack the servers your web application is connected to. While downloading or installing any npm modules or packages, make sure they are trusted and take out time to ensure they are not going to make your application insecure.
Session secret is essentially a key which maintains the state of the current session by utilizing cookies in the browser.
Yes. Nodejs has full control over the settings of the web server whereas PHP requires Apache web server to run.
NPM forever is a module which turns the server back on if it shuts down due to any unintended reason and ensures your web application stays alive.
By Pooja Gera
