Questions tagged [node.js]

Node.js is an event-based, non-blocking, asynchronous I/O framework that uses Google's V8 JavaScript Engine.

node.js, commonly just called "Node", is often used for developing applications that rely on the ability to run javascript both on the client and server side. Running the same language on both the client and the server benefits from improved code reusability and the less context switching.

180 questions
136
votes
4 answers

Do I need CSRF token if I'm using Bearer JWT?

Context : Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (withCredentials = false by default) and I use JWT Bearer…
Igor Pomogai
  • 1,463
  • 2
  • 10
  • 7
57
votes
7 answers

Does it make sense to consider a triggerable server software crash a DOS attack?

I've found a little vulnerability in a web application running on Node.js server. It works by sending some crafted payload to the application server, which makes the application server code to throw an error and due to lack of error handling - It…
Matías
  • 507
  • 1
  • 4
  • 4
40
votes
3 answers

Predicting Math.random() numbers?

I was reading up on the documentation for Math.random() and I found the note: Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more…
Abe Miessler
  • 8,185
  • 12
  • 53
  • 75
23
votes
3 answers

How to prevent directory traversal when joining paths in node.js?

I have a node.js webapp in which I need to concatenate two paths in a safe way. The first one (leftmost) is a constant, and the second one (rightmost) is relative to the first one and comes from untrusted user input. The resulting path should be…
Anders
  • 66,033
  • 25
  • 190
  • 228
18
votes
2 answers

Where to store private and public keys?

I'm new to backend and currently don't know best practices of storing sensitive data in safe. I configured node.js server with JWT. I signed JWT with RSA key. Each time server receive request it verifies integrity of JWT. For now I have 2 files…
Roman Mahotskyi
  • 283
  • 1
  • 2
  • 6
16
votes
1 answer

Unpublished modules on npm: could an attacker take advantage of their former notoriety?

Earlier this week, Azer Koçulu decided to unpublish his modules from npm , the default package manager for Node.js . He had published 273 modules in total. Some major modules, like Babel and React, relied on one of them: left-pad , and a lot of npm…
Benoit Esnard
  • 14,754
  • 7
  • 72
  • 71
11
votes
2 answers

Cryptographically secure number generator for node.js

I am looking for a cryptographically secure number generator for node.js. Afaik. Math.random() does not meet these requirements. Is there any nodejs lib which can generate cryptographically secure numbers?
inf3rno
  • 489
  • 1
  • 8
  • 22
10
votes
0 answers

Should the risk of antivirus products be reconsidered in light of the TrendMicro critical bug report

Tavis Ormandy of Google has recently discovered a critical TrendMicro design flaw identified in this bug report - TrendMicro node.js HTTP server listening on localhost can execute commands . The bug report reads to me like a Stephen King novel of…
zedman9991
  • 3,447
  • 19
  • 22
9
votes
1 answer

Why sign session cookies?

I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ID cookie.…
TrueWill
  • 375
  • 3
  • 11
8
votes
2 answers

Why does node.js scrypt function use HMAC this way?

According to the documentation , the scrypt hash function works like so: The hash function does the following: Adds random salt. Creates a HMAC to protect against active attack. Uses the scrypt key derivation function to derive a hash for a key.…
ChrisD
  • 235
  • 2
  • 5
8
votes
4 answers

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of password changes, I check for password(hashed)…
Gopinath Shiva
  • 181
  • 1
  • 1
  • 4
8
votes
3 answers

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious code was published to the npm registry. This…
alecxe
  • 1,635
  • 6
  • 20
  • 36
8
votes
6 answers

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order objects were created. Does not give away total…
Anders
  • 66,033
  • 25
  • 190
  • 228
7
votes
5 answers

In NodeJS, what is a good way of ensuring user submitted data in (text input) forms is not malicious?

In addition to scanning user uploaded files, I would also like to ensure that forms for user profiles, comments, etc. cannot be misused to submit malicious script. What are some known good methods of doing so? Should checking for script injection…
ahron
  • 423
  • 1
  • 4
  • 16
7
votes
3 answers

Socket.IO Client Security

I am new to Node.js and Socket.IO. According to documentation the client side code is something like: <script src="/socket.io/socket.io.js"></script> <script> var socket = io('http://localhost:3000'); socket.on('news', function (data) {…
Cemre
  • 315
  • 1
  • 5
  • 9
1
2 3
…
11 12