I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "isBoolean" etc.
I guess I must also check the authorization header. It is submitted in the login form as basic auth, through the authorization header. So the header looks like this for example:
Using https://github.com/ctavan/express-validator I would really appreciate any help on the strategy on how to validate the input here.
In order to extract the username and password I use
var auth = require('basic-auth'); //and var info = auth(req); //getting info.user and info.pass
I am also curious whether this does any input validation by default. The documentation of basic-auth says
auth(req) Get the basic auth credentials from the given request. The Authorization header is parsed and if the header is invalid, undefined is returned, otherwise an object with name and pass properties.
I am not sure what this means - invalid in what way etc. It would be neat if this does sufficient validation in itself, but I doubt it.
Main question is how to "clean" this from injection attacks and scripts. It is base64 encoded, so I guess I would have to decode it and then clean it. But maybe that poses som risk in itself?
Any help on how to approach this would be greatly appreciated.