JSConfBR - Securing Node.js App, by the community and for the community

1. Securing Node.js apps,
by the community and
for the community

2. Hi, I’m David

3. Hi, I’m David
@ diasdavid

4. Hi, I’m David
@diasdavid

6. Direct
Flight
Image

9. Node Security Project

10. Security before node

11. Input Validation
Output Validation
Error Handling
Authentication and Authorization
Session Management
Secure Communications
Secure Resource Access
Segregation of privileges
Secure Storage

12. You are responsible
for what you
require()

13. What has changed?

14. What has changed?
you

15. http://nodeschool.io

16. Node Security Project

18. npm install all the things

19. npm install fs

20. npm install socketio

21. ~/analyzer$ node print.js ./output/output.json
buffer: 604
child_process: 2867
dgram: 836
dns: 674
fs: 15036
http: 12084
https: 2819
os: 1311
readline: 909
string_decoder: 65
timers: 230
tty: 335
vm: 354

22. 404

24. New Process

32. Resources that you
can use today

33. https://nodesecurity.io/resources

34. Advisories

35. npm shrinkwrap
/validate/shrinkwrap
/validate/:module_name/:version
POST
GET

36. npm shrinkwrap example
curl -X POST https://nodesecurity.io/
validate/shrinkwrap -d @npm-
shrinkwrap.json -H "content-type:
application/json"

37. nsp cli
$ npm i nsp -g
$ npm shrinkwrap
$ nsp shrinkwrap

38. node goat
https://github.com/owasp/nodegoat

39. Thank you!
@daviddias | @LiftSecurity | @nodeSecurity