Slides from my talk at Node.js Conference 2016 - Italy

1. Let’s talk Security
Securing Your Node.js App
Dheeraj Joshi
@dheerajhere

2. ● Front-End @
● Open Source (medium-cli)
● Ambidextrous TT Player
About Me

3. More...
I wear White Hat.
Uber, CKEditor, Dropbox,
MailChimp, Recruiterbox, InVision,
DigitalOcean, Intuit, Groupon, etc.
What makes me happy?

4. Agenda
● Why ?
● Cross-site Scripting (XSS)
● Cross-site Request Forgery (CSRF)
● Content Security Policy (CSP)
● Useful Headers
● Other Best Practices
● Demo

5. Why should Startups
Care about Security?
Startups & SMEs are known to cut
corners. One of the first things they
cut is ‘Security'.

7. Github
Reused password attack

8. HACKER PUTS HOSTING SERVICE “CODE
SPACES” OUT OF BUSINESS
The Shutdown

9. CROSS SITE SCRIPTING - XSS
● XSS attack users
● “Javascript Injection”
● Exploits can be bad,
really bad..

10. What is XSS?
Typical Reflected XSS

11. Stored XSS

12. Protect Yourself
● Input Validation
● Ensure that outputs are
HTML encoded
● Don’t reinvent the wheel
(Use proven sanitizers)

13. Content Security Policy (CSP)

14. Add Content Security Policy header

15. ● Add HTTPOnly, Secure attributes on Session
Cookie

16. CROSS-SITE REQUEST
FORGERY (CSRF)

17. Because the attack is carried out
by the victim, CSRF can bypass:
● HTTP Auth
● Session-based auth
● Firewalls
CSRF Attacks

18. Prevention

19. ● Only accepting POST requests
● Referer Protection
● Multi-Step Transactions
● URL Rewriting
● application/json
“CSRF Myths”
Preventions that Won’t work

20. XSS + CSRF = ? (Demo)

21. List of useful HTTP headers
● Strict-Transport-Security:
max-age=16070400; includeSubDomains
● X-Frame-Options: deny
● X-XSS-Protection: 1; mode=block

22. Prevent Information Disclosure
Hide X-Powered-By
Or try this ;)

23. How to improve ?
● SECURITY.md
● Security Middleware
(helmet.js, kraken.js )
● OWASP Node Goat
Project
● NSP, Snyk

24. Questions ?

25. Thank you
@dheerajhere
@djadmin