OWASP Top 10 Security Vulnerabilities and Prevention

// Bad - No authorization check
app.get('/admin/users', (req, res) => {
  User.find().then(users => res.json(users));
});

// Good - Check permissions
app.get('/admin/users', [
  auth,
  authorize('admin'),
  async (req, res) => {
    const users = await User.find();
    res.json(users);
  }
]);

// Authorization middleware
const authorize = (role) => {
  return (req, res, next) => {
    if (req.user.role !== role) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    next();
  };
};

import bcrypt from 'bcrypt';
import crypto from 'crypto';

// Hash passwords
const hashedPassword = await bcrypt.hash(password, 10);

// Encrypt sensitive data
const algorithm = 'aes-256-gcm';
const key = crypto.scryptSync(password, 'salt', 32);
const iv = crypto.randomBytes(16);
const cipher = crypto.createCipheriv(algorithm, key, iv);

let encrypted = cipher.update(data, 'utf8', 'hex');
encrypted += cipher.final('hex');

const authTag = cipher.getAuthTag();

// Store encrypted with iv and authTag

// Bad - Concatenation
const query = `SELECT * FROM users WHERE id = '${userId}'`;

// Good - Parameterized
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);

// Best - ORM
const user = await User.findByPk(userId);

// Bad - Direct injection
const query = { $where: `this.email === '${email}'` };

// Good - Mongoose built-in methods
const user = await User.findOne({ email });

// Disable debug mode in production
if (process.env.NODE_ENV === 'production') {
  app.disable('x-powered-by');
  app.use(helmet());
}

// Secure session configuration
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,
    httpOnly: true,
    maxAge: 3600000,
    sameSite: 'strict',
  }
}));

// CORS configuration
const corsOptions = {
  origin: process.env.ALLOWED_ORIGINS?.split(','),
  credentials: true,
};

# Audit dependencies
npm audit

# Fix vulnerabilities
npm audit fix

# Automated scanning
npm install -g snyk
snyk test

// Strong password requirements
const passwordSchema = Joi.string()
  .min(8)
  .pattern(/^(?=.*[a-z])(?=.*[A-Z])(?=.*d)(?=.*[@$!%*?&])/)
  .required();

// Rate limiting
import rateLimit from 'express-rate-limit';

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many login attempts',
});

app.post('/login', loginLimiter, loginHandler);

// Multi-factor authentication
const generateOTP = () => {
  return speakeasy.totp({
    secret: process.env.OTP_SECRET,
    encoding: 'base32',
  });
};

# Use package-lock.json
npm ci

# Verify dependencies
npm audit verify

# Subresource Integrity (SRI)
<link
  rel="stylesheet"
  href="style.css"
  integrity="sha384-..."
  crossorigin="anonymous"
>

import winston from 'winston';

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' }),
  ],
});

// Log security events
app.use((req, res, next) => {
  logger.info({
    method: req.method,
    url: req.url,
    ip: req.ip,
    userAgent: req.get('user-agent'),
  });
  next();
});

// Alert on suspicious activity
if (failedAttempts > 5) {
  logger.error('Possible brute force attack', { ip: req.ip });
  // Send alert
}

import { URL } from 'url';

// Validate URLs
const isValidUrl = (urlString) => {
  try {
    const url = new URL(urlString);

    // Block private IPs
    const hostname = url.hostname;
    const blocked = ['localhost', '127.0.0.1', '0.0.0.0'];

    if (blocked.includes(hostname)) {
      return false;
    }

    // Only allow HTTPS
    if (url.protocol !== 'https:') {
      return false;
    }

    // Allowlist domains
    const allowedDomains = ['api.example.com'];
    if (!allowedDomains.includes(hostname)) {
      return false;
    }

    return true;
  } catch {
    return false;
  }
};

app.post('/fetch', async (req, res) => {
  const { url } = req.body;

  if (!isValidUrl(url)) {
    return res.status(400).json({ error: 'Invalid URL' });
  }

  const response = await fetch(url);
  const data = await response.json();
  res.json(data);
});