Node.js Security
summary
Covers concrete Node/Express fixes for OWASP Top 10: uses static analysis like ScanJS and vuln databases (nsp/Snyk/retire) to find package holes, shows firewall options (mod_security/WAF) and cites mass MongoDB ransom attacks (100k+ open DBs) as a common misconfiguration. Demonstrates middleware: Helmet, csurf, express-rate-limit, CSP and safe file upload patterns; recommends bcrypt/PBKDF2 for passwords, parameterized queries, session and cookie flags, and automated npm audits.
AI-written summary · about
chapters (23)
- 0:00Intro
- 4:13TOP 2 VULNERABILITIES
- 5:24BUG FIXING COST
- 8:57UNVALIDATED REDIRECTS AND FORWARDS
- 11:07USING COMPONENTS WITH KNOWN VULNERABILITIES
- 12:47HOW TO CHOOSE NPM PACKAGES?
- 18:16CROSS-SITE REQUEST FORGERY (CSRF)
- 20:42MISSING FUNCTION LEVEL ACCESS CONTROL
- 23:43SENSITIVE DATA EXPOSURE
- 24:49CAN I PREVENT SNIFFING?
- 27:34JAVASCRIPT CRYPTOGRAPHY
- 29:33SECURITY MISCONFIGURATION
- 34:58INSECURE DIRECT OBJECT REFERENCES
- 36:42CROSS-SITE SCRIPTING (XSS)
- 45:08NODE.JS AUTHENTICATION
- 47:03NODE.JS ACCESS CONTROL
- 47:45SESSIONS
- 48:29SECURE PASSWORDS STORAGE
- 50:16JAVASCRIPT INJECTION
- 50:57COMMAND INJECTION
- 51:35FILE UPLOAD SECURITY
- 53:19TRY IT YOURSELF
- 53:54QUESTIONS?
