Tools Used to Test and Detect Application Security Vulnerabilities
Tags: node, devops, tutorial, security
Published: 2023-02-23 12:31:18

_**Note**_: This article focuses on Node.js applications. 

Please check my article on running simple automated tests for your Node.js application. 
{% embed https://dev.to/pavanbelagatti/automating-tests-for-your-nodejs-application-5hd9 %}

In this digital age, where everything is connected to the internet and data is everything, security becomes essential for any application, especially those built on Node.js. Node.js is a robust JavaScript-based runtime environment for developing web applications, APIs, and server-side applications. It is famous for its scalability and versatility, but it also comes with its own security risks that must be addressed. In this blog post, we will discuss the importance of application security for Node.js applications and provide a comprehensive guide on the various tools and strategies available for strengthening security. 

## Node.js and Application Security
Node.js is an open-source, cross-platform JavaScript runtime environment for developing web and server-side applications. It is used by millions of developers worldwide because of its scalability and versatility. It is also an ideal platform for developing real-time applications, such as chat applications or multiplayer games. However, like any other platform, Node.js has its own security risks. Therefore, it is essential to consider application security when developing Node.js applications. Application security protects applications from unauthorised access, data loss, data alteration, and malicious attacks. It is a continuous process that requires regular monitoring and updating of security measures.

## Automating Security Tests in Node.js
Automating security tests is an essential part of ensuring that applications are secure. Automated security tests can help organizations identify and fix potential vulnerabilities in the application code. This can help organizations reduce the risk of data breaches and ensure compliance with industry regulations. To automate security tests in Node.js, organizations should use security tools that are specifically designed for Node.js applications. These tools can be used to scan code and identify potential vulnerabilities. They can also be used to run automated security tests regularly.

## Prerequisites
- [Harness cloud account](https://app.harness.io/auth/#/signup/?module=ci&utm_source=internal&utm_medium=social&utm_campaign=devadvocacy&utm_content=pavan_node_scan_article&utm_term=get-started) to run tests and scanning 
- GitHub account so you can fork this [sample application](https://github.com/pavanbelagatti/Simple-Node-App) to see how security scanning works

## Tutorial
Harness is a leading software delivery platform with a CI module that helps developers set up continuous integration and delivery pipeline quickly. 

Sign up for the [free Harness cloud](https://www.harness.io/products/continuous-integration?utm_source=internal&utm_medium=social&utm_campaign=devadvocacy&utm_content=pavan_node_scan_article&utm_term=get-started) account. Once you sign up and verify your account, you will be presented with a welcome message and project creation set-up. Proceed to create a project.
![get started](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xnspbd4m751ynare1tj1.png)

Add the name to the project, save and continue.
![project details](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jhlk9q9cymgphnzq7u7c.png)

Select the ‘Continuous Integration’ module and start your free plan. 
![continuous integration module](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o5gcrxxp99dd84d4gw6a.png)

You can start creating your first pipeline.
![First pipeline](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z70949j21zp6s8w9zigv.png)

Click on ‘Get Started’ and connect your SCM tool/platform where the application code is present. 
![GitHub authentication](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vcotdt3yftydup4dk3gy.png)

Once your SCM integration connection is successful, pick your repository and begin your pipeline configuration. 
![repo select](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kknt3wn4qxrt44d3gqwa.png)

Since we are working with a Node.js application, let’s select Node.js and proceed to create the pipeline. 
![configure nodejs application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p67gnzt2toythmxwf828.png)

Once you click on ‘Create Pipeline’, you will see the pipeline studio as shown below with default settings. 
![build nodejs application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ipb4tnq4noe0e5zpduha.png)

Click ‘Build Node App’ to see the pipeline configuration. You should see the following page.
![pipeline studio Harness](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ww3u4esj6kh3trnixog2.png)

If you click on the ‘Build Node App’ under the ‘Execution’ tab, you should see the ‘Run’ step configured for you by default.
![configure run step](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hivt3zp37ev77icdov4q.png)

You can see node and npm commands in the ‘Command’ tab.
You can keep the mentioned commands or replace and add only the important ones. 

We will just keep `npm install` and `npm test`

Apply changes, save the configuration and run the pipeline. You should see the tests passing.
![run pipeline](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rpezhz6dwa90rw330a9q.png)

![successful pipeline](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z5dr6oqen79fmqq2hvek.png)

Now, let’s add more tests to your Node.js application to strengthen it, so it is all error-free before deploying it. 
![node security testing configuration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4996wusdga4qt4exx6lz.png)

You can extend the security and vulnerability testing of your application by using the [Harness security testing orchestration](https://www.harness.io/products/security-testing-orchestration?utm_source=internal&utm_medium=social&utm_campaign=devadvocacy&utm_content=pavan_node_security_article&utm_term=get-started) (STO) module. 

In the execution tab, you can add a step and choose ‘Security’.
![STO Harness](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jomooq8l34u7i66s9xkk.png)

You can configure any security tool in the pipeline, such as [Snyk](https://snyk.io/), [Bandit](https://bandit.readthedocs.io/en/latest/), OWASP, etc.

You can see that I have configured the OWASP, Snyk, Bandit and Aqua Trivy scan for my application.
![security testing tools](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xdhtlbvj4gfqz61j5jna.png)

After selecting the STO step, you need to add details of the security framework/tool you would like to use for your project.

For example, I have configured the Snyk test with the following details. Sign up for Snyk for free and get the SNYK_TOKEN to add in the details below. 

The other details include,

`policy_type = orchestratedScan`
`scan_type = repository`
`product_name = snyk`
`product_config_name = default`
`repository_project = Simple-Node-App` [This is our project name from the [forked repo](https://github.com/pavanbelagatti/Simple-Node-App)]
`repository_branch = <+codebase.branch>`
`SNYK_TOKEN = Add your snyk token here`

![snyk test](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7bfm7kfpebx5in7qp9gl.png)

Apply changes and save the pipeline. 

Similarly, configure the OWASP, Bandit and Aqua Trivy scan.
![OWASP Scan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s5cippa3so92hab4hdfq.png)

Below is the setting for the Bandit scan
![Bandit scan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/54hxx4gn7z7mwuu7ag45.png)

Below is the setting for the Aqua Trivy scan
![aqua trivy scan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m0l845x3vr8z0uftgexl.png)

At this point, your pipeline should look like this,
![final pipeline](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cb60w9zd8i6lgazzj8qa.png)

Now, save everything and run the pipeline to see the test and vulnerability report.
![all security tests passing](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fffct4ircrfmr69sjn3c.png)

You can see that the scans ran successfully. It is time to see our application's test report and vulnerabilities.

Click on the ‘Security Tests’, and you should see the vulnerability dashboard as below
![security test report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b4ih0fcsdvgymskp6bmq.png)

You can dig deeper into the vulnerability and possible remediation steps by clicking on them. An example is shown below.
![security vulnerabilities](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ts021r1b0ml1nst5mh8p.png)

That’s how you can not only find but also fix the issues found in your application and container images. 

### Conclusion
Application security is essential for protecting Node.js applications from malicious attacks and data breaches. Organizations should use the right tools and strategies for strengthening security, such as security testing, secure coding best practices, DevSecOps, and monitoring and logging security events. By following these best practices, organizations can protect their Node.js applications from malicious attacks and ensure compliance with industry regulations. So, if you're looking for ways to strengthen the security of your Node.js applications, this blog post is a great place to start. I hope you found this helpful guide and that it helps you protect your applications from malicious attacks.