Closed tienthanh411 closed 2 years ago
Thanks for reporting this, i've fixed this in commit https://github.com/snoopysecurity/dvws-node/commit/d0c33a6a892495341343ba2e98ca334609a01660, can you check if this happens again?
Thanks! The problem is still there, but less severe though. I ran an ZAP active scan, and still more than 100 Mongoose connections were opened.
I could see that you have added calls to mongoose.connect() again after the commit. Maybe that's the reason why the problem is still there.
You only need to create 1 Mongoose connection in index.js
when starting the server, and remove all the calls to mongoose.connect() in the controllers (similar to what you did in commit d0c33a6a892495341343ba2e98ca334609a01660). This is an example how it could be done: https://github.com/madhums/node-express-mongoose-demo/blob/master/server.js
Yeah good point, I initially tried this approach but didn't get it working but the example you provided makes sense. I tried fixing this with commit https://github.com/snoopysecurity/dvws-node/commit/6c022d8364d48745ee00849d4d53965f9f4fc38b, mind scanning with ZAP again? thanks
Closing this issue, i think this is fixed now, i scanned with Burp Pro to verify this
Hi,
I deployed the project in a Docker container and tried to attack the APIs using OWASP ZAP. With the OWASP ZAP's active scanner, the web container showed more than 700 Mongoose connection after few seconds:![image](https://user-images.githubusercontent.com/349428/126157298-f8b632db-0052-4873-95ea-bd46ce6422f3.png)
After this, the web server didn't respond anymore.