Node.js Express Framework Security Issues

Question

I'm looking for modules that should be added to a Node/Express app that address the general security concerns listed below:

Injection Vulnerabilities (JavaScript, SQL, Mongo, HTML)
Session fixation and hijacking
Cross-Site Vulnerabilities (Scripting, Request Forgery)
Mass Assignment
insert relevant concern here

Thanks for your help!

----------

Some resources I've found:

Excellent talk (11/2012): http://lanyrd.com/2012/asfws/sxzbm/ (see slides)

ServerFault question (2011-2012): https://serverfault.com/questions/285123/is-node-js-mature-for-enterprise-security

Blog post on topic (9/2012): http://codefol.io/posts/29-Why-Rails-and-not-Sinatra-or-Node-js-

Exploit tester: https://code.google.com/p/skipfish/

Passport Module: https://github.com/jaredhanson/passport

EveryAuth Module: https://github.com/bnoguchi/everyauth

score 46 · Accepted Answer · edited Feb 14 '14 at 17:36

I wrote a blog post that gives a great starting point on Writing Secure Express.js Apps. It covers a few other things beyond csrf and helmet as was mentioned by zeMirco.

The other thing is you can't compare express.js to rails. They are apples and oranges. For example, there is no ORM that is bundled with Express, that implementation or use of a third party module is up to you.

I'll try and give a breakdown of each of your concerns.

-Injection Vulnerabilities (JavaScript, SQL, Mongo, HTML)

Again, these are things not built into express. The closest thing would be XSS worries over injection in templates. Jade or EJS templates that are commonly used with express output encode < > " ' and & by default, but remember there are other contexts like user input into JavaScript or CSS that you would need to worry about.

-Session fixation and hijacking

Again see the blog post above, but Express is based on and uses most of the connect middleware one of these is the session middleware. Biggest thing here is to properly set your cookie flags.

-Cross-Site Vulnerabilities (Scripting, Request Forgery)

See above. It also comes with express.csrf() middleware. The blog post mentioned shows how to implement it.

-Mass Assignment

Not an issue with express.js as it has no concepts in which this type of vulnerable would be applicable, however the custom logic you write may be in fact vulnerable to this problem, so again it's a problem of verifying if your code is vulnerable or if the third party module you used is...

Wow, thanks for this detailed response and the excellent blog post! I'll try to get these up and running! — D.Deriso, Feb 01 '13 at 23:00
Blog post link seems to be dead. Here is another resource for some common Express.js security concerns: https://gist.github.com/cerebrl/6487587 — Jesse Clark, Dec 09 '13 at 18:41

score 9 · Answer 2 · answered Jan 30 '13 at 19:47

9

Two modules I can immediately think of:

csrf: CRSF protection middleware.
helmet: Middleware that implement various security headers

answered Jan 30 '13 at 19:47

zemirco

16,171
8
62
96

Thanks for sharing, I'll check these out! – D.Deriso Jan 30 '13 at 19:56

score 7 · Answer 3 · answered Sep 06 '13 at 23:23

7

One thing to be wary of is bodyParser. See http://andrewkelley.me/post/do-not-use-bodyparser-with-express-js.html

answered Sep 06 '13 at 23:23

andrewrk

30,272
27
92
113

score 1 · Answer 4 · answered Oct 21 '13 at 09:21

You should be aware that if you specify a catch-all error handler, you should NOT restart the server or do anything blocking in that handler in response to USER errors (the 4xx range) because it could lead to a DOS vulnerability. This vulnerability is addressed automatically in express-error-handler, and the service will shut down as soon as it can (when active connections are drained or a timeout occurs) so restarts shouldn't be a big deal. Implementing this behavior made a really big difference in my exploit tests.

BTW, it's NOT safe to simply ignore all unhandled errors. That would leave your application in an undefined state, which just presents another type of DOS vulnerability.

Node.js Express Framework Security Issues

----------

4 Answers4

Linked