Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [node.js]

Node.js is an event-based, non-blocking, asynchronous I/O framework that uses Google's V8 JavaScript Engine.

0
votes
1answer
89 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
0
votes
0answers
15 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
57
votes
7answers
11k views

Does it make sense to consider a triggerable server software crash a DOS attack?

I've found a little vulnerability in a web application running on Node.js server. It works by sending some crafted payload to the application server, which makes the application server code to throw ...
0
votes
2answers
76 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
1
vote
2answers
127 views

Can I use RSA to encrypt an AES256 key that I put at the beginning of my AES256 encrypted file?

I have a master server generating large files for other (known) servers to download. Those files: Are quite big. From 20MB to 5GB. Are written once by the server and then it forgets about them. ...
0
votes
2answers
82 views

Authenticated Sessions on a Desktop Application

I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
5
votes
3answers
519 views

Is this password-less auth flow secure?

I'd like to implement a password-less auth flow for my mobile app that only requires a user clicking a link in their email to log in. Similar to how Slack handles auth. I'll be using node and jwt for ...
1
vote
0answers
145 views

How to bypass a public API's usage limit block? [closed]

I'm trying to build a database with information that I can get with a lot of http GET requests to the target server's API. The problem is that they obviously do have restrictions. After 80+ requests,...
0
votes
1answer
41 views

Best strategy to share some sensitive user data between Node and PHP

I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I ...
1
vote
1answer
203 views

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
7
votes
3answers
726 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
-1
votes
1answer
138 views

Secure Admin Password in Open Source Software

I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string ...
2
votes
0answers
122 views

Adding a custom block cipher to Node JS?

I have a modified version of openssl with a custom TLS cipher that I am testing. How would I use it in Node JS? I have pointed the modified version of openssl to Node JS using the LD_LIBRARY_PATH. I ...
3
votes
0answers
223 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
1
vote
1answer
217 views

How to avoid response manipulation in NodeJS Application?

I have a NodeJS application on the server. The attacker from the client system already knows how the success response looks like for a request. Next time he sends a request with wrong credentials, ...
4
votes
1answer
78 views

how is security maintained in session and JWT?

I have been using passport JS session for a long time without really caring about security concern. For next project I thought of replacing session with JWT but security related concerns arise as I ...
2
votes
0answers
105 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
-1
votes
1answer
779 views

Generate multiple secure unique random codes in Node.js? [duplicate]

I am using the below method to generate multiple unique random codes of 14 digits: var randNum = Math.floor(Math.random() * timestamp * 100); var number = randNum.toString().substr(0, 14); Is this ...
0
votes
1answer
197 views

NodeJs app files integrity security check [closed]

What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check? There are usually huge number of files in node_modules/, ...
1
vote
0answers
132 views

Keep email password secure for Node JS automatic email system

I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update ...
1
vote
0answers
32 views

Securing data tokens [duplicate]

What is the proper way to save and access database and API credentials in my node js application? Currently I use a dotenv package and store them in a .env file. I am not uploading my code to github ...
2
votes
2answers
616 views

Web Attack: CCTV-DVR Remote Code Execution (Node.js - Swedish string.js URL)

I have been using node.js and running live-server package in my project for a while with the following command: node node_modules/live-server/live-server.js . --ignore=\"css/sass\" --open=./ --cors ...
0
votes
1answer
956 views

Should one use separate SSL certificates for front-end and back-end?

I have a website hosted by Apache on a Linux server. I also have a Node.js back-end/API that is hosted on the same server, which serves all the front-end's requests. Today I set up SSL for the front-...
2
votes
1answer
129 views

How do JavaScript access control libraries work and is a client solution not a security threat?

As a complete beginner in this area I am looking at various Access Control libraries for my JavaScript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are ...
2
votes
0answers
82 views

Node.js ENV VAR Security

Recently I had a debate with a fellow dev about where to store Node.js env vars. I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
0
votes
1answer
700 views

Own password manager. How to store passwords [closed]

I want to play a little bit and create my own little password manager (with gpg) in node.js My question is how I should keep those passwords: In one encrypted file (let's say in json format), ...
1
vote
0answers
31 views

WSS assign login token on socket?

Is it secure to assign the login token on the socket object? This would be done to avoid having to consistently send their tokens over an encrypted established WebSocket connection. The token would be ...
17
votes
3answers
16k views

Do I need CSRF token if I'm using Bearer JWT?

Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (...
0
votes
1answer
1k views

Node.js http-proxy-middleware: secure connection between servers

I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with ...
0
votes
1answer
106 views

Strength of below aes encryption

Need to store encrypted user code in our database and get the decrypted form in return. Using the standard node module crypto to do so. Wanted to understand the strength of below encryption in terms ...
1
vote
1answer
133 views

Securing a Web URL when called by a client application

We are developing a single page Angular2/NodeJS app which will have a web based form for our users to fill and submit.We do not have any Web based application for our users to login to (so no SSO), ...
1
vote
1answer
298 views

Can a user tamper with my client side code to skip HTML sanitization, if yes, how can I prevent it?

In my code, the first AJAX call to the server checks the recaptcha and sanitises the data. Is there a way for a malicious user to skip that process ? Since this is client side javascript, could he ...
1
vote
0answers
355 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
3
votes
1answer
562 views

Find vulnerability in node.js web service to reveal secret key for admin

I've tried to solve the following "hacking" challenge in order to get experience with web vulnerabilities. The service is programmed in node.js and is accessible as http://lbs-course.askarov.net:...
6
votes
1answer
707 views

How safe is PassportJS out of the box?

If I have an NodeJS server (an express server) that requires a user to log in before rendering files, how safe is PassportJS to use out-of-the-box? Currently I am using it with express-session ...
1
vote
0answers
617 views

Validating user input in authorization header (node.js express-validator)

I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "...
4
votes
0answers
65 views

What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?

I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
0
votes
1answer
120 views

Allowing customer to generate a secret key for securing RDS instance on AWS

I have an microservice architecture running on AWS ECS cluster using Postgres and Node and there is this requirement that we need to somehow allow our client to lock our database with a secret key ...
2
votes
1answer
869 views

What Does This Command Do? Should i be worried?

So I was debugging my code when I see these few lines in my log: GET /cgi/common.cgi 302 8.015 ms - 23 GET /stssys.htm 302 2.928 ms - 23 GET / 200 134.922 ms - 9896 POST /command.php 302 33.826 ms - ...
1
vote
0answers
89 views

Exploting Query Selector injection in ExpressJS

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data GET /findInfo?user=12345678 HTTP/1.1 Host: ...
1
vote
0answers
126 views

is my stack secure on mongodb if i use mongos out-of-box username/password roles? [closed]

is my stack secure on mongodb if i use mongos out-of-box username/password and roles for generating tokens, and I do not personally attempt to come up with a salt+hash for usernames & passwords (...
6
votes
2answers
4k views

Cryptographically secure number generator for node.js

I am looking for a cryptographically secure number generator for node.js. Afaik. Math.random() does not meet these requirements. Is there any nodejs lib which can generate cryptographically secure ...
0
votes
1answer
103 views

passing user input to command line

I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure. The user enters a password, which is then ...
2
votes
3answers
5k views

Unclosable instance of Node.js runs on Startup

I've noticed in my task manager, an unclosable instance of server side Node.js running on my HP Laptop (running windows 10), after a little digging around I was wondering if it means I'm now ...
3
votes
2answers
351 views

Authenticate a browser that has no user input (a kiosk) from another browser

I'm building a dashboard for a client. It starts up in Chrome kiosk mode and begins displaying all activity for the day's transactions continously on a screen placed high on the wall. They asked for ...
2
votes
1answer
3k views

Handling jwt token expiration

I have a koajs based nodejs backend for my personal/hobby app. I implemented session handling with jwt tokens. Now the client gets his token after a successful login authentication so my angularjs ...
3
votes
2answers
288 views

Checking a locally stored string for tamper

I'm working on a multiplayer game using WebSockets. I've decided all user data will be stored on the client, eliminating the need for authentication using passwords etc. LocalStorage 'save' -> '{"...
0
votes
1answer
437 views

Is Node.js on Debian Jessie really insecure?

As I was reading the release notes for Debian Jessie, I came upon these paragraphs: The Node.js platform is built on top of libv8-3.14, which experiences a high volume of security issues, but ...
0
votes
2answers
2k views

Protect Node.js Server Code

Situation/Enviorment: I have a project written which's core is an NodeJs Web- and API-Server. I'd like to sell it to multiple clients, they will host the server on their system. Problem: The NodeJs-...
1
vote
1answer
155 views

Bypass bcrypt max input

I was reading this question regarding bcrypt max password length. Is there a preferred method or way to allow user passwords to be unlimited length? Or at least much higher? Is there an alternative ...