Owasp Security

OWASP Top 10 Security

Prevent common security vulnerabilities in web applications.

OWASP Top 10 (2021)

A01: Broken Access Control

Prevention Patterns

// ❌ BAD: No authorization check
app.get('/api/users/:id', async (req, res) => {
  const user = await db.users.findById(req.params.id);
  res.json(user);
});

// ✅ GOOD: Verify ownership
app.get('/api/users/:id', authenticate, async (req, res) => {
  const userId = req.params.id;
  
  // Users can only access their own data
  if (req.user.id !== userId && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  const user = await db.users.findById(userId);
  res.json(user);
});

// ✅ GOOD: Role-based access control (RBAC)
const requireRole = (...roles: string[]) => {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!roles.includes(req.user?.role)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
};

app.delete('/api/posts/:id', authenticate, requireRole('admin', 'moderator'), deletePost);

Insecure Direct Object Reference (IDOR)

// ❌ BAD: Predictable IDs exposed
GET /api/invoices/1001
GET /api/invoices/1002  // Can enumerate others' invoices

// ✅ GOOD: Use UUIDs + ownership check
app.get('/api/invoices/:id', authenticate, async (req, res) => {
  const invoice = await db.invoices.findOne({
    id: req.params.id,
    userId: req.user.id,  // Enforce ownership
  });
  
  if (!invoice) {
    return res.status(404).json({ error: 'Not found' });
  }
  
  res.json(invoice);
});

A02: Cryptographic Failures

Password Hashing

import bcrypt from 'bcrypt';

// ❌ BAD: Plain text or weak hashing
const hash = md5(password);  // Never use MD5
const hash = sha1(password);  // Never use SHA1

// ✅ GOOD: bcrypt with cost ≥ 12
const hashPassword = async (password: string): Promise<string> => {
  return bcrypt.hash(password, 12);
};

const verifyPassword = async (password: string, hash: string): Promise<boolean> => {
  return bcrypt.compare(password, hash);
};

Secure Headers

import helmet from 'helmet';

// ✅ GOOD: Security headers
app.use(helmet());
app.use(helmet.hsts({ maxAge: 31536000 }));
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],
  },
}));

A03: Injection

SQL Injection Prevention

// ❌ BAD: String concatenation
const query = `SELECT * FROM users WHERE id = ${userId}`;
const result = await db.query(query);

// ✅ GOOD: Parameterized queries
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [userId]);

// ✅ GOOD: ORM methods
const user = await User.findByPk(userId);

NoSQL Injection Prevention

// ❌ BAD: Direct object injection
const query = { username: req.body.username, password: req.body.password };
const user = await User.findOne(query);

// ✅ GOOD: Validate against schema
const schema = z.object({
  username: z.string().min(3).max(50),
  password: z.string().min(8),
});

const data = schema.parse(req.body);
const user = await User.findOne(data);

Command Injection Prevention

// ❌ BAD: Shell command with user input
const { exec } = require('child_process');
exec(`git log --author="${author}"`, callback);

// ✅ GOOD: Use execFile with array arguments
const { execFile } = require('child_process');
execFile('git', ['log', '--author', author], callback);

A04: Insecure Design

Rate Limiting

import rateLimit from 'express-rate-limit';

// ✅ GOOD: Rate limiting on sensitive endpoints
const authLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5, // 5 attempts
});

app.use('/api/auth/', authLimiter);

Input Validation

import { z } from 'zod';

// ✅ GOOD: Schema validation
const userSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).regex(/[A-Z]/).regex(/[0-9]/),
});

const data = userSchema.parse(req.body);

A05: Security Misconfiguration

Environment Configuration

// ❌ BAD: Hardcoded secrets
const apiKey = 'sk_live_1234567890abcdef';

// ✅ GOOD: Environment variables
const apiKey = process.env.API_KEY;

// ❌ BAD: Debug mode in production
app.use(express.json({ debug: true }));

// ✅ GOOD: Conditional debug
app.use(express.json({ debug: process.env.NODE_ENV !== 'production' }));

A06: Vulnerable Components

Dependency Scanning

# Regularly audit dependencies
npm audit
npm audit fix

# Use Snyk for continuous monitoring
npx snyk test
npx snyk monitor

A07: Authentication Failures

Secure Session Management

// ✅ GOOD: Secure cookie configuration
app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 24 * 60 * 60 * 1000, // 24 hours
  },
}));

Multi-Factor Authentication

// ✅ GOOD: Implement MFA for sensitive operations
const enableMFA = async (userId: string) => {
  const secret = speakeasy.generateSecret();
  await User.update(userId, { mfaSecret: secret.base32 });
  return secret.otpauth_url;
};

const verifyMFA = (token: string, secret: string): boolean => {
  return speakeasy.totp.verify({
    secret,
    encoding: 'base32',
    token,
  });
};

A08: XSS Prevention

Content Security Policy

// ✅ GOOD: CSP headers
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'unsafe-inline'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", 'data:', 'https:'],
  },
}));

Input Sanitization

import DOMPurify from 'dompurify';

// ❌ BAD: Direct HTML rendering
<div dangerouslySetInnerHTML={{ __html: userContent }} />

// ✅ GOOD: Sanitize HTML
const cleanContent = DOMPurify.sanitize(userContent);
<div dangerouslySetInnerHTML={{ __html: cleanContent }} />

A09: Logging & Monitoring

Security Event Logging

// ✅ GOOD: Log security events
logger.info('User login', { userId, ip, timestamp });
logger.warn('Failed login attempt', { email, ip, reason });
logger.error('Access denied', { userId, resource, action });

A10: SSRF Prevention

URL Validation

// ❌ BAD: Direct fetch with user input
const data = await fetch(userProvidedUrl);

// ✅ GOOD: Validate against allowlist
const ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'];

const isValidUrl = (url: string): boolean => {
  try {
    const parsed = new URL(url);
    return ALLOWED_DOMAINS.includes(parsed.hostname);
  } catch {
    return false;
  }
};

if (isValidUrl(userProvidedUrl)) {
  const data = await fetch(userProvidedUrl);
}

Security Checklist

Before deploying, verify:

• Passwords hashed with bcrypt (cost ≥ 12)
• JWT tokens have short expiry
• Session cookies are httpOnly, secure, sameSite
• Rate limiting on auth endpoints
• All endpoints have auth checks
• RBAC implemented correctly
• No IDOR vulnerabilities
• All input validated
• SQL queries parameterized
• XSS prevented (CSP, escaping)
• HTTPS enforced
• Security headers configured
• Dependencies audited
• Secrets in environment variables
• Security events logged

Resources

• OWASP Top 10
• OWASP Cheat Sheets
• Node.js Security