I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "isBoolean" etc.

I guess I must also check the authorization header. It is submitted in the login form as basic auth, through the authorization header. So the header looks like this for example:

Basic dGhhbmtzZm9ydGFraW5nOnRpbWVoZWxwaW5nbWU6KQ==

Using https://github.com/ctavan/express-validator I would really appreciate any help on the strategy on how to validate the input here.

In order to extract the username and password I use

var auth = require('basic-auth'); //and
var info = auth(req); //getting info.user and info.pass

I am also curious whether this does any input validation by default. The documentation of basic-auth says

auth(req) Get the basic auth credentials from the given request. The Authorization header is parsed and if the header is invalid, undefined is returned, otherwise an object with name and pass properties.

I am not sure what this means - invalid in what way etc. It would be neat if this does sufficient validation in itself, but I doubt it.

Main question is how to "clean" this from injection attacks and scripts. It is base64 encoded, so I guess I would have to decode it and then clean it. But maybe that poses som risk in itself?

Any help on how to approach this would be greatly appreciated.

  • I am a bit new to this particular forum. Maybe I will move this question, or copy it, to other main forums. It seems activity is a bit lower here maybe. – BenM Mar 16 '17 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.