First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue.

I have built a JSON communication between a front-end (website) and my Node.js web server. I want to keep in mind, that I might extend my front-end to mobile apps so I allow Access-Control-Allow-Origin: *. Now securing API to my Node.js web server is a big issue. I am new to the topic of security and want to show you a draft of how I want to build up my security before I ask my questions:

General procedure: I am validating every input data on the client side - this includes not only checking if e.g. the supplied email is of a correct format, but also escapes possible XSS inputs with htmlspecialchars(). I do an HTTP POST Ajax with my validated data and access token (in HTTP header) to the back-end. In the back-end I discard requests which don't match any DB record with userid (in session object) + access token in my tokenDB. Finally. I am validating data AGAIN on the back-end as well.

How I do my registration and login:

  1. Registration form with text fields which are hidden with CSS and email verification.

    • hidden fields to prevent spambots
    • email verification to make life harder for manual spammers
  2. Logging in: email and password is directly sent to the server and if a user record is found in the userDB

    • the login succeeds
    • userid + randomly generated access token + date > is entered into the tokenDB
    • userid is saved in a session and an access token is returned in HTTP header 'accessToken'

I hope this quick draft provides you with enough information for a qualified feedback.

My questions:

  1. Is the validation I am doing enough? What possibilities of XSS/other threats haven't I eliminated?
  2. Is the htmlspecialchars() translation enough to prevent XSS?
  3. Did I understand the concept of the access token correctly?
  4. How do I create an access token?
  5. Is it enough to store the userid in the session?
  6. Is HTTPS necessary? -> I don't want to pay for certificates
  7. What is your overall impression of my security draft?

I hope you understood my explanation of the concept of securing my API. I really hope to get some professional feedback!

Thank you, MZ

  • Are passwords hashed or in the clear? HTTPS is absolutely necessary from a security standpoint. You can generate your own self-signed certificate rather than paying for one. However this will require users to accept a 3rd-party certificate. Depending on what your does you could provide login through Facebook/Google+ and have them generate tokens for you. This link might help with generating your own: stackoverflow.com/questions/17141292/… Sorry I can't comment on the other questions. – RoraΖ Aug 25 '14 at 14:32
  • im doing the password hashing in backend and saving this hash in the db. So basicly i compare the hash(login-pwd) with db-pwd during authentication/authorization. Thank you for your feedback and the provided link :) – Matthias Zimmermann Aug 26 '14 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.