First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue.
I have built a JSON communication between a front-end (website) and my Node.js web server. I want to keep in mind, that I might extend my front-end to mobile apps so I allow Access-Control-Allow-Origin: *. Now securing API to my Node.js web server is a big issue. I am new to the topic of security and want to show you a draft of how I want to build up my security before I ask my questions:
General procedure: I am validating every input data on the client side - this includes not only checking if e.g. the supplied email is of a correct format, but also escapes possible XSS inputs with
htmlspecialchars(). I do an HTTP POST Ajax with my validated data and access token (in HTTP header) to the back-end. In the back-end I discard requests which don't match any DB record with userid (in session object) + access token in my tokenDB. Finally. I am validating data AGAIN on the back-end as well.
How I do my registration and login:
Registration form with text fields which are hidden with CSS and email verification.
- hidden fields to prevent spambots
- email verification to make life harder for manual spammers
Logging in: email and password is directly sent to the server and if a user record is found in the userDB
- the login succeeds
- userid + randomly generated access token + date > is entered into the tokenDB
- userid is saved in a session and an access token is returned in HTTP header 'accessToken'
I hope this quick draft provides you with enough information for a qualified feedback.
- Is the validation I am doing enough? What possibilities of XSS/other threats haven't I eliminated?
- Is the
htmlspecialchars()translation enough to prevent XSS?
- Did I understand the concept of the access token correctly?
- How do I create an access token?
- Is it enough to store the userid in the session?
- Is HTTPS necessary? -> I don't want to pay for certificates
- What is your overall impression of my security draft?
I hope you understood my explanation of the concept of securing my API. I really hope to get some professional feedback!
Thank you, MZ