Security in Node.JS and Express: The bare minimum - Part 2.
Tags: javascript, node, security, webdev
Published: 2020-04-10 09:28:43

---
title: Security in Node.JS and Express: The bare minimum - Part 2.
published: true
description: Easy ways to secure an Express application
tags: #javascript #node #security #webdev
---
In the previous part, we covered
* Server side JS injection
* “Use strict”
* Helmet
* Changing default error pages
* Proper session management

{% post https://dev.to/demetrakopetros/security-in-node-js-and-express-the-bare-minimum-part-1-98o %}

In this part, we will cover
* XSS Attacks
* SQL injections 
* RegEx Denial of Service

# XSS Attacks in general

XSS attacks (or Cross - Site Scripting) allows intruders to execute scripts in the victims’ browser. In that way, they can access cookies, session tokens and other sensitive info or redirect users to malicious sites. It is one of the most common ways an intruder can take over a webpage.

Example:
Let's say we have the following sign-up form that sends data to our Express server:
![A typical sign-up form](https://dev-to-uploads.s3.amazonaws.com/i/twa5ukoldgfizh1kplr1.png)

If we do nothing about it, '<script>alert(document.cookie)</script>' will be saved in the username field in our database backend and when we fetch and render the username of the specific user in the future, the user will see the following alert.

![Cookie alert](https://dev-to-uploads.s3.amazonaws.com/i/yfbv8f18j50v95bo7n3v.png)

As you can imagine, this vulnerability may have catastrophic consequences as it may expose critical information and data. Actually some of the most famous attacks in the web have been performed by exploiting this vulnerability. A classic example is this [2014 attack in Twitter](https://www.theguardian.com/technology/2014/jun/11/twitter-tweetdeck-xss-flaw-users-vulnerable).

## XSS Attacks - How to prevent them

There is a bunch of things we can do to secure our Express server for XSS-attacks. First of all, we should always perform **data validation and sanitization**. This means that for every incoming request we should check that the input parameters given by the user are in the correct format, the one that the server and the database expect to be. Another useful tip is to set the cookie `httpOnly` value to `true` because it prevents cookies from being accessed by browser JS scripts.
```Javascript
app.use(express.session({
    secret: "s3Cur3",
    cookie: {
        httpOnly: true,
        secure: true
    }
})
```
Also, we should always HTML Escape data before inserting it into HTML Elements (ex: convert & to &amp; and < to &lt; etc). This will probably neutralize some XSS threats. We should also do this for JSON values presented in an HTML context and read the data with `JSON.parse()`.
Finally, we should use [“XSS” npm package](https://www.npmjs.com/package/xss) that will perform many of the counter-measures mentioned above for use.

#SQL injections in general

Let's that in a login endpoint, we receive the username and the password of the user in the following way (to simplify the case, let's assume that no password hashing policy is performed).

```Javascript
app.post('/login', function (req, res) {
var username = req.body.username;
var password = req.body.password;

var sql = 'SELECT * FROM Users WHERE Name ="' + username+ '" AND Pass ="' + password + '"'
// and then executing the query in our SQL databse
});
```
What if the malicious user type  " or “"=" in username and password fields ?
thw SQL  query that we are ready to execute will look like this:
```
SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""="" 
```

`OR ""=""` condition is always true!
So the query returns all the rows of “Users” table.

##SQL injections - How to prevent them
Once again, data validation and sanitization is the best way to eliminate these threats. NPM Packages like [sqlstring](https://www.npmjs.com/package/sqlstring) ,  escape user input values and thus it makes the vulnerability very difficult for a malicious user to exploit it. Also, packages like [sql-query-builder](https://www.npmjs.com/package/sql-query-builder) that offer you the ability to create SQL queries in a more structured way like this
```Javascript
query().select([users.id.as('User'), users.id.count(1)])
    .from(users).join(posts)
    .on(posts.user_id).equals(users.id)
    .groupBy(users.id);
```
are far better in security terms than string concatenated SQL queries.

# RegEx Denial of Service 
Some Regular Expressions may be “unsafe” for some inputs, i.e `(a+)+` regex is unsafe for input `aaaaaaaaaaaaaaaaaaaaa!` as it will lead the regex evaluation to exponential time complexity causing the server to Denial of Service.

Fortunately there is an NPM package that helps us detect vulnerable RegExes and it is called [“safe-regex”](https://www.npmjs.com/package/safe-regex)
It is used like this:
```Javascript
var safe = require(‘safe-regex’);
var regex = new RegExp(‘(a+)+’);
console.log(safe(regex));
```
It will return a boolean value indicating if the regex is safe or not.

# That's all folks (for now...)

I hope you find it interesting and it will help you build more secure and robust Node.JS and Express apps.
In the next part we will cover Cross-Site Request Forgery, Rate Limiting and Data Sanitization.