Common Node.js security vulnerabilities in Node.js - Mini Project: Build & Apply

Common Node.js Security Vulnerabilities

📖 Scenario: You are building a simple Node.js server that handles user input and serves data. To keep your server safe, you need to understand common security problems and how to avoid them.

🎯 Goal: Build a basic Node.js server that demonstrates common security vulnerabilities and how to fix them step-by-step.

📋 What You'll Learn

Create a basic Express server with a user input route

Add a configuration variable to control input validation

Implement input validation to prevent injection attacks

Add security headers using Helmet middleware

💡 Why This Matters

🌍 Real World

Web servers often receive input from users. Without validation and security headers, they can be vulnerable to attacks like injection or cross-site scripting.

💼 Career

Understanding and fixing common Node.js security vulnerabilities is essential for backend developers to build safe and reliable applications.

1

Set up a basic Express server

Create a file called server.js. Import express and create an app using const app = express(). Add a route /submit that accepts POST requests and reads user input from req.body.input. Use express.json() middleware to parse JSON bodies. Finally, listen on port 3000.

Node.js

const express = require('express')
const app = express()
app.use(express.json())

// Your code here

Hint

Remember to use express.json() middleware to parse JSON input.

2

Add input validation configuration

Add a constant called validateInput and set it to true. This will control whether the server validates user input before processing.

Node.js

const express = require('express')
const app = express()
app.use(express.json())

// Your code here

app.post('/submit', (req, res) => {
  const userInput = req.body.input
  res.send(`Received input: ${userInput}`)
})

app.listen(3000, () => {
  console.log('Server running on port 3000')
})

Hint

This variable will help us turn input validation on or off easily.

3

Add input validation to prevent injection

Inside the /submit route, add a check that runs only if validateInput is true. Validate that userInput is a string and contains only letters and numbers using a regular expression /^[a-zA-Z0-9]+$/. If invalid, respond with status 400 and message 'Invalid input'. Otherwise, continue to send the received input.

Node.js

const express = require('express')
const app = express()
app.use(express.json())

const validateInput = true

app.post('/submit', (req, res) => {
  const userInput = req.body.input
  // Your code here
  res.send(`Received input: ${userInput}`)
})

app.listen(3000, () => {
  console.log('Server running on port 3000')
})

Hint

Use a regular expression to allow only letters and numbers.

4

Add Helmet middleware for security headers

Import helmet at the top. Use app.use(helmet()) before your routes to add security headers that protect against common vulnerabilities.

Node.js

const express = require('express')
// Your code here
const app = express()
app.use(express.json())

const validateInput = true

app.post('/submit', (req, res) => {
  const userInput = req.body.input
  if (validateInput) {
    if (typeof userInput !== 'string' || !/^[a-zA-Z0-9]+$/.test(userInput)) {
      return res.status(400).send('Invalid input')
    }
  }
  res.send(`Received input: ${userInput}`)
})

app.listen(3000, () => {
  console.log('Server running on port 3000')
})

Hint

Helmet helps add important security headers automatically.

Practice

1. Which of the following is a common security vulnerability in Node.js applications?

easy

A. Memory Leak

B. SQL Injection

C. Slow Network

D. Syntax Error

Solution

1. Step 1: Understand common vulnerabilities

   SQL Injection is a well-known security risk where attackers inject malicious SQL code.

2. Step 2: Identify relevant options

   Memory leaks and slow networks are performance issues, syntax errors are coding mistakes, not security vulnerabilities.

3. Final Answer:

   SQL Injection -> Option B

4. Quick Check:

   Common Node.js security risk = SQL Injection [OK]

Hint: Security risks often involve data injection or unauthorized access [OK]

Common Mistakes:

• Confusing performance issues with security vulnerabilities
• Thinking syntax errors are security problems
• Ignoring injection attacks

2. Which syntax correctly prevents Cross-Site Scripting (XSS) in a Node.js Express app when rendering user input in a template?

easy

A. res.send(`${escape(userInput)}`);

B. res.render('page', { data: userInput });

C. res.send(`${userInput}`);

D. res.send(userInput);

Solution

1. Step 1: Identify safe rendering method

   Escaping user input before inserting into HTML prevents XSS attacks.

2. Step 2: Compare options

   Only res.send(`
   ${escape(userInput)}`); uses an escape function to sanitize input before sending.

3. Final Answer:

   res.send(`
   ${escape(userInput)}
   `); -> Option A

4. Quick Check:

   Escape user input to prevent XSS = res.send(`
   ${escape(userInput)}
   `); [OK]

Hint: Always escape user input before rendering in HTML [OK]

Common Mistakes:

• Sending raw user input directly in HTML
• Assuming template rendering auto-escapes input
• Not using escape functions

3. What will be the output of this Node.js code snippet vulnerable to prototype pollution?

const obj = {};
const payload = JSON.parse('{"__proto__": {"polluted": "yes"}}');
Object.assign(obj, payload);
console.log({}.polluted);

medium

A. Throws an error

B. undefined

C. null

D. "yes"

Solution

1. Step 1: Understand prototype pollution

   Assigning __proto__ property modifies the prototype of all objects.

2. Step 2: Analyze code behavior

   Object.assign merges payload into obj, changing Object prototype to include polluted property.

3. Step 3: Check console.log output

   Accessing {}.polluted reads from prototype, outputs "yes".

4. Final Answer:

   "yes" -> Option D

5. Quick Check:

   Prototype pollution sets property globally = "yes" [OK]

Hint: Prototype pollution changes all objects' properties unexpectedly [OK]

Common Mistakes:

• Expecting undefined instead of polluted value
• Not recognizing __proto__ effect
• Assuming error thrown on prototype pollution

4. Identify the security flaw in this Express middleware code:

app.use((req, res, next) => {
  const token = req.headers['authorization'];
  if (token) {
    req.user = jwt.verify(token, 'secret');
  }
  next();
});

medium

A. Not checking token expiration

B. Using synchronous jwt.verify instead of async

C. Missing error handling for invalid token

D. Not sanitizing user input

Solution

1. Step 1: Review token verification

   jwt.verify can throw if token is invalid, but no try-catch is used.

2. Step 2: Identify missing error handling

   Without try-catch, invalid tokens cause app crash or unhandled exceptions.

3. Final Answer:

   Missing error handling for invalid token -> Option C

4. Quick Check:

   Always catch errors from jwt.verify [OK]

Hint: Wrap jwt.verify in try-catch to handle invalid tokens [OK]

Common Mistakes:

• Ignoring exceptions from jwt.verify
• Assuming synchronous call is insecure
• Confusing input sanitization with token validation

5. You want to secure a Node.js app against outdated package vulnerabilities. Which approach is best to keep dependencies safe?

hard

A. Run 'npm audit' regularly and update vulnerable packages

B. Ignore warnings and only update major versions yearly

C. Manually edit package-lock.json to remove vulnerabilities

D. Use only packages without any dependencies

Solution

1. Step 1: Understand package vulnerability management

   npm audit scans for known vulnerabilities in dependencies.

2. Step 2: Choose best practice

   Regularly running npm audit and updating packages fixes security issues promptly.

3. Step 3: Evaluate other options

   Ignoring warnings risks attacks, manual edits are error-prone, and avoiding dependencies is impractical.

4. Final Answer:

   Run 'npm audit' regularly and update vulnerable packages -> Option A

5. Quick Check:

   Use npm audit and update often = Run 'npm audit' regularly and update vulnerable packages [OK]

Hint: Use npm audit and update packages regularly [OK]

Common Mistakes:

• Ignoring audit warnings
• Editing lock files manually
• Avoiding dependencies completely