I do have multiple applications in .NET. Now I want that each user can talk within its application with other users of the same application. Therefore I programmed a node.js/socket.io-server. Everything runs fine in development!

Now I consider some security issues as my applications run on wildcard ssl (*.mydomain.com).

  1. How to secure my webserver within node.js (no GET/POST requests are needed).
  2. How to secure the websocket.

The docs of socket.io are very poor as they don't mention anything in v1.x.

  • Please consider a reason for downvoting as I'm new to security.stackexchange.com. Thank you! – webprogrammer May 20 '15 at 9:29
  • "How to secure my webserver?" is a very broad question. Is there a specific issue with security that you're having? Questions asking for "all the vulnerabilities" are difficult to provide complete answers to. – RoraΖ May 20 '15 at 11:22
  • Thanks @raz for your feedback. In fact I'd like to secure it from outside - so that just my applications are allowed to connect to the node.js-server. The node-server is running on IIS 8 with iisnode. My question wasn't so specific because I wanted to know several solutions. I'm very new to this topic and the docs aren't very well documented. – webprogrammer May 20 '15 at 11:32

Based on the comments following your question there are two items you can configure to better protect your users.

Tune your socket.io implementation:

  1. Upgrade your socket.io implementation to use 2.x.
  2. Make use of the 'socket.io#origins' configuration to eliminate the default CORS wildcard for any domain.
  3. Use authenticated sessions within the socket.io connection. See 'socket.io#adapter' or the 'session.socket.io' module alternative.

Tune your sites security headers:

  1. Run your site (if publicly available) through https://securityheaders.com to test your current implementation.
  2. Make use of the guide(s) at OWASP for more options regarding securing your site such as this one regarding use of the newer security headers available in browsers. https://www.owasp.org/index.php/List_of_useful_HTTP_headers
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.