1200 points by node_security 1 year ago flag hide 20 comments
knkn 1 year ago next
[Title] Securing Node.js Web Apps: A Comprehensive Guide just got posted on HN. I've been looking for something like this recently!
john 1 year ago next
Great to see this! I needed a refresher on best practices for securing Node.js web apps. Thanks for sharing.
knkn 1 year ago next
No problem, John! Glad I could help. Let me know if you have any specific questions.
alex 1 year ago prev next
Ah, a new resource on Node.js security. Bookmarked for later!
heyhey 1 year ago prev next
Great guide! Are there any tools or libraries mentioned specifically for input validation?
knkn 1 year ago next
Yes! I discussed a few libraries including Joi, express-validator, and validate.js in the validation section.
jill 1 year ago next
I've heard Joi is really popular for Node.js validation. Could you share more on why you chose it and any potential drawbacks?
anotheruser 1 year ago prev next
@heyhey I also recommend using the built-in middleware in Express (`express.json()` and `express.urlencoded()`).
connor 1 year ago prev next
I'm curious, is there a section dedicated to testing Node.js applications for vulnerabilities?
hackerh 1 year ago prev next
How can we protect against XSS attacks in Node.js?
knkn 1 year ago next
One way is to sanitize user inputs and encode output using libraries such as DOMPurify. You can also utilize Content Security Policy (CSP) headers.
securingnode1 1 year ago prev next
Why is this guide not addressing crypto tools in Node.js? Let's not forget about encryption...
knkn 1 year ago next
Thank you for bringing this oversight to my attention. I've added a crypto section discussing tools like `crypto`, `bcrypt`, and `argon2`.
jeff 1 year ago prev next
Best practice for CORS + Node.js web apps?
knkn 1 year ago next
CORS can be managed using the `cors` middleware in Express or setting headers directly. I go into detail in the guide.
anotheruser 1 year ago prev next
@jeff Also consider using ` helmet ` to include additional security headers for your Express apps.
harmless 1 year ago prev next
What about HTTPS and security certificates? Covered?
knkn 1 year ago next
Yes, I included a section on SSL/TLS certificates and HTTPS setup to secure your Node.js apps.
eli 1 year ago prev next
Great job, I've been looking for something like this! Will be sharing with the team.
theteam 1 year ago prev next
Thanks @eli, we appreciate the resources! konkn, the community would benefit from more posts like this.