Questions tagged [node.js]

Node.js is an event-based, non-blocking, asynchronous I/O framework that uses Google's V8 JavaScript Engine.

0
votes
1answer
29 views

What should I use to encrypt data between a centralized server and multiple devices running NodeJS?

I have a centralized server and DB that each of my devices polls every ten seconds. The centralized server may respond with a list of "active jobs", which the devices will then run. I need to ensure ...
0
votes
0answers
45 views

Potentially unusual open ports on my Mac [closed]

I did a portscan recently for open ports on my mac and had some slightly unusual results: I ran sudo lsof -n -i :{port} | grep LISTEN on all of these and got back associations with the following ...
0
votes
1answer
74 views

Safe alternative for the `x-forwarded-proto` header?

I'm trying to redirect all http requests to https for a node.js express server deployed on Heroku. To that extent, I'm testing the x-forwarded-proto header of the request like this: app.use(function(...
0
votes
0answers
63 views

Server Side Template Injection for EJS template in NodeJS

I'd like to create a Web-App with Server-Side Template Injection vulnerability in NodeJS. The template used in the Application is EJS with Express-Framework. Below are the code bits: index.js (...
0
votes
1answer
50 views

No certificate found alert in nodejs https server in mobile

I have created a website using nodejs . And using ssl certificate from sslforfree.com . It is working fine on desktop and i checked it in SSL Checker it is working fine . But in mobile it is showing ...
2
votes
2answers
169 views

Rest API Authentication with JWT

This is my first time working with JWTs so I decided to ask here on Information Security as I'm very unsure about my approach towards JWT Authentication. I'm currently working on an API that will ...
1
vote
0answers
48 views

Invocation of a trusted NodeJS script tries to connect to unkown IP

I have a houskeeping script which I invoked using node index.js which got me this output The error is because you cannot connect to the IP, but why would it try to connect to it in the first place? ...
0
votes
1answer
254 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
0
votes
0answers
103 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
57
votes
7answers
12k views

Does it make sense to consider a triggerable server software crash a DOS attack?

I've found a little vulnerability in a web application running on Node.js server. It works by sending some crafted payload to the application server, which makes the application server code to throw ...
0
votes
2answers
109 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
1
vote
2answers
154 views

Can I use RSA to encrypt an AES256 key that I put at the beginning of my AES256 encrypted file?

I have a master server generating large files for other (known) servers to download. Those files: Are quite big. From 20MB to 5GB. Are written once by the server and then it forgets about them. ...
0
votes
2answers
192 views

Authenticated Sessions on a Desktop Application

I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
6
votes
3answers
695 views

Is this password-less auth flow secure?

I'd like to implement a password-less auth flow for my mobile app that only requires a user clicking a link in their email to log in. Similar to how Slack handles auth. I'll be using node and jwt for ...
1
vote
0answers
276 views

How to bypass a public API's usage limit block? [closed]

I'm trying to build a database with information that I can get with a lot of http GET requests to the target server's API. The problem is that they obviously do have restrictions. After 80+ requests,...
0
votes
1answer
44 views

Best strategy to share some sensitive user data between Node and PHP

I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I ...
1
vote
1answer
235 views

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
7
votes
3answers
769 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
-1
votes
1answer
156 views

Secure Admin Password in Open Source Software

I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string ...
2
votes
0answers
149 views

Adding a custom block cipher to Node JS?

I have a modified version of openssl with a custom TLS cipher that I am testing. How would I use it in Node JS? I have pointed the modified version of openssl to Node JS using the LD_LIBRARY_PATH. I ...
3
votes
0answers
266 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
1
vote
1answer
259 views

How to avoid response manipulation in NodeJS Application?

I have a NodeJS application on the server. The attacker from the client system already knows how the success response looks like for a request. Next time he sends a request with wrong credentials, ...
4
votes
1answer
90 views

how is security maintained in session and JWT?

I have been using passport JS session for a long time without really caring about security concern. For next project I thought of replacing session with JWT but security related concerns arise as I ...
2
votes
0answers
116 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
-1
votes
1answer
929 views

Generate multiple secure unique random codes in Node.js? [duplicate]

I am using the below method to generate multiple unique random codes of 14 digits: var randNum = Math.floor(Math.random() * timestamp * 100); var number = randNum.toString().substr(0, 14); Is this ...
0
votes
1answer
234 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...
1
vote
0answers
139 views

Keep email password secure for Node JS automatic email system

I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update ...
1
vote
0answers
33 views

Securing data tokens [duplicate]

What is the proper way to save and access database and API credentials in my node js application? Currently I use a dotenv package and store them in a .env file. I am not uploading my code to github ...
2
votes
2answers
674 views

Web Attack: CCTV-DVR Remote Code Execution (Node.js - Swedish string.js URL)

I have been using node.js and running live-server package in my project for a while with the following command: node node_modules/live-server/live-server.js . --ignore=\"css/sass\" --open=./ --cors ...
0
votes
1answer
1k views

Should one use separate SSL certificates for front-end and back-end?

I have a website hosted by Apache on a Linux server. I also have a Node.js back-end/API that is hosted on the same server, which serves all the front-end's requests. Today I set up SSL for the front-...
2
votes
1answer
135 views

How do JavaScript access control libraries work and is a client solution not a security threat?

As a complete beginner in this area I am looking at various Access Control libraries for my JavaScript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are ...
2
votes
0answers
84 views

Node.js ENV VAR Security

Recently I had a debate with a fellow dev about where to store Node.js env vars. I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
0
votes
1answer
762 views

Own password manager. How to store passwords [closed]

I want to play a little bit and create my own little password manager (with gpg) in node.js My question is how I should keep those passwords: In one encrypted file (let's say in json format), ...
1
vote
0answers
32 views

WSS assign login token on socket?

Is it secure to assign the login token on the socket object? This would be done to avoid having to consistently send their tokens over an encrypted established WebSocket connection. The token would be ...
30
votes
3answers
21k views

Do I need CSRF token if I'm using Bearer JWT?

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
0
votes
1answer
2k views

Node.js http-proxy-middleware: secure connection between servers

I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with ...
0
votes
1answer
106 views

Strength of below aes encryption

Need to store encrypted user code in our database and get the decrypted form in return. Using the standard node module crypto to do so. Wanted to understand the strength of below encryption in terms ...
1
vote
1answer
139 views

Securing a Web URL when called by a client application

We are developing a single page Angular2/NodeJS app which will have a web based form for our users to fill and submit.We do not have any Web based application for our users to login to (so no SSO), ...
1
vote
1answer
328 views

Can a user tamper with my client side code to skip HTML sanitization, if yes, how can I prevent it?

In my code, the first AJAX call to the server checks the recaptcha and sanitises the data. Is there a way for a malicious user to skip that process ? Since this is client side javascript, could he ...
1
vote
0answers
381 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
2
votes
1answer
650 views

Find vulnerability in node.js web service to reveal secret key for admin

I've tried to solve the following "hacking" challenge in order to get experience with web vulnerabilities. The service is programmed in node.js and is accessible as http://lbs-course.askarov.net:...
6
votes
1answer
821 views

How safe is PassportJS out of the box?

If I have an NodeJS server (an express server) that requires a user to log in before rendering files, how safe is PassportJS to use out-of-the-box? Currently I am using it with express-session ...
1
vote
0answers
715 views

Validating user input in authorization header (node.js express-validator)

I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "...
4
votes
0answers
67 views

What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?

I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
0
votes
1answer
123 views

Allowing customer to generate a secret key for securing RDS instance on AWS

I have an microservice architecture running on AWS ECS cluster using Postgres and Node and there is this requirement that we need to somehow allow our client to lock our database with a secret key ...
2
votes
1answer
878 views

What Does This Command Do? Should i be worried?

So I was debugging my code when I see these few lines in my log: GET /cgi/common.cgi 302 8.015 ms - 23 GET /stssys.htm 302 2.928 ms - 23 GET / 200 134.922 ms - 9896 POST /command.php 302 33.826 ms - ...
1
vote
0answers
93 views

Exploting Query Selector injection in ExpressJS

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data GET /findInfo?user=12345678 HTTP/1.1 Host: ...
1
vote
0answers
136 views

is my stack secure on mongodb if i use mongos out-of-box username/password roles? [closed]

is my stack secure on mongodb if i use mongos out-of-box username/password and roles for generating tokens, and I do not personally attempt to come up with a salt+hash for usernames & passwords (...
7
votes
2answers
5k views

Cryptographically secure number generator for node.js

I am looking for a cryptographically secure number generator for node.js. Afaik. Math.random() does not meet these requirements. Is there any nodejs lib which can generate cryptographically secure ...
0
votes
1answer
106 views

passing user input to command line

I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure. The user enters a password, which is then ...