Node.js: Security

Introduction

• Securing your Node.js projects
• What you should know

1. Security Overview

• Introduction to OWASP and other sources
• OWASP Top 10 in Node.js
• Overview of broken access control
• Overview of cryptographic failures
• Overview of injections

2. Best Practices: Packages

• Hands-on base template overview
• Maintain package dependencies
• Add 2-factor and read-only tokens with NPM

3. Best Practices: Data

• Data handling with type and validation
• Use prepared statements for SQL and NoSQL
• Set proper HTTP headers with Helmet
• Encrypt user data and session management

4. Best Practices: Server Level

• Use secure HTTPS protocol
• Rate limiting against DoS attacks
• Use a library to prevent CSRF attacks
• Use cookie attributes

5. Tools for Testing

• Introduction to OWASP dependency check
• Find vulnerabilities with Snyk
• Penetration testing with Burp Suite

Conclusion

• Next steps