Meet security requirements from Node.js checklist - Githubissues

cadomani / course-management-system

Group project for Software Modeling and Design (COMP3700)

https://cms.kltpzyxm.live

3 stars 1 forks source link

Meet security requirements from Node.js checklist #33

Open cadomani opened 2 years ago

cadomani commented 2 years ago

Node.js Checklist

Configuration Management

[x] Security HTTP Headers
- Set automatically by CloudFlare
- Need to disable Heroku endpoint

Authentication

[ ] Brute Force Protection
- Rate Limiter Flexible

Session Management

[x] Cookie Flags/Scope
- Managed by express-sessions
[ ] Implement CSRF protection
- Mitigate CSRF attacks by adding a token to each page visited
- Use csurf

Data Validation

[ ] XSS Attacks
- Partly mitigated by strong OpenAPI schema
- Add Joi support
[x] SQL Injection
- No direct user input is turned into queries
- Prisma ORM sanitizes any fall-through queries
[x] Command injection
- N/A as no relative paths are handled by query items

Secure Transmission

[ ] SSL Version, Algorithms, Key length
- Need to run against nmap and sslyize
[x] HSTS
- Enforced by Helmet
- HTTPS Redirection by CloudFlare

Denial of Service

[ ] Account lockout
- Rate limiting required
[x] Regular Expression
- No known regex commands currently ran in-server
[x] DDOS
- Handled by CloudFlare

Error Handling

[x] Error Codes, Stack Traces
- X-Powered-By header disabled by Helmet

cadomani commented 2 years ago

Change #40 allows an XSS forgery attack, should patch before release