Security Resources (Educate)

[misterdai]

Like the idea of this project, would certainly help a lot of developers get started on better footer with security aspects. I think it'd be useful if this module also provided suggestions and resources to encourage better security practises as well. That way a developer can be educated on other areas of security that may not be within the realm of this module, or requires more custom code, as well as suggestions of alternatives (un-biased) that are probably a better idea to use if budgets are available and scale requires.

• Provide a list of important security aspects that this module doesn't (and won't) cover, with recommendations. Such as: Password hashing (bcrypt, scrypt etc...), session rotation, cookie signing...
• Possibly recommend investigation of WAFs (Web Applicaiton Firewalls), if budgets allow or hosting provides (AWS for example).
• Other database injections like nosql based ones. https://zanon.io/posts/nosql-injection-in-mongodb

Not suggesting a huge amount of information, but a few links to useful resources can always help educate any developers using the module :)

[gergelyke]

Great idea @misterdai ! What would you add? Do you have a few links which you'd like to see?

[misterdai]

Thanks :) How about something like the following that I threw together?

---

Security Recommendations

Other Aspects

There are plenty of other areas that you should be concerned about when it comes to security, that this module doesn't cover (yet or won't) for various reasons. Here are a few that are worth researching:

• Password Hashing
  • Bcrypt modules: bcrypt,bcryptjs, bcrypt-as-promised
  • Scrypt modules: scrypt, scryptsy, scrypt-async
• NoSQL Injection
• Session management
• CSRF - Cross Site Request Forgery
  • CSURF Express Module
• Signed Cookies: cookie-parser Express Module

Resources

• OWASP -Open Web Application Security Project
• Express: Production Best Practices
• RisingStack: Node.js Security Checklist

Dedicated WAF

If you have the resources available (budget or hosting environment), a dedicated WAF (Web Application Firewall) can offer a robust solution to various security issues, such as blocking potential attackers and flagging their activity.

• OWASP WAF information
• Hosting providers:
  • AWS WAF
  • Microsoft Azure WAF
• [ModSecurity]() - Apache, nginX and other web servers.
• CloudFlare - External WAF features.

[gergelyke]

looks good! can you send a PR please?