Common Node.js security vulnerabilities in Node.js - Mini Project: Build & Apply

Common Node.js Security Vulnerabilities

📖 Scenario: You are building a simple Node.js server that handles user input and serves data. To keep your server safe, you need to understand common security problems and how to avoid them.

🎯 Goal: Build a basic Node.js server that demonstrates common security vulnerabilities and how to fix them step-by-step.

📋 What You'll Learn

Create a basic Express server with a user input route

Add a configuration variable to control input validation

Implement input validation to prevent injection attacks

Add security headers using Helmet middleware

💡 Why This Matters

🌍 Real World

Web servers often receive input from users. Without validation and security headers, they can be vulnerable to attacks like injection or cross-site scripting.

💼 Career

Understanding and fixing common Node.js security vulnerabilities is essential for backend developers to build safe and reliable applications.

1

Set up a basic Express server

Create a file called server.js. Import express and create an app using const app = express(). Add a route /submit that accepts POST requests and reads user input from req.body.input. Use express.json() middleware to parse JSON bodies. Finally, listen on port 3000.

Node.js

const express = require('express')
const app = express()
app.use(express.json())

// Your code here

Need a hint?

Remember to use express.json() middleware to parse JSON input.

2

Add input validation configuration

Add a constant called validateInput and set it to true. This will control whether the server validates user input before processing.

Node.js

const express = require('express')
const app = express()
app.use(express.json())

// Your code here

app.post('/submit', (req, res) => {
  const userInput = req.body.input
  res.send(`Received input: ${userInput}`)
})

app.listen(3000, () => {
  console.log('Server running on port 3000')
})

Need a hint?

This variable will help us turn input validation on or off easily.

3

Add input validation to prevent injection

Inside the /submit route, add a check that runs only if validateInput is true. Validate that userInput is a string and contains only letters and numbers using a regular expression /^[a-zA-Z0-9]+$/. If invalid, respond with status 400 and message 'Invalid input'. Otherwise, continue to send the received input.

Node.js

const express = require('express')
const app = express()
app.use(express.json())

const validateInput = true

app.post('/submit', (req, res) => {
  const userInput = req.body.input
  // Your code here
  res.send(`Received input: ${userInput}`)
})

app.listen(3000, () => {
  console.log('Server running on port 3000')
})

Need a hint?

Use a regular expression to allow only letters and numbers.

4

Add Helmet middleware for security headers

Import helmet at the top. Use app.use(helmet()) before your routes to add security headers that protect against common vulnerabilities.

Node.js

const express = require('express')
// Your code here
const app = express()
app.use(express.json())

const validateInput = true

app.post('/submit', (req, res) => {
  const userInput = req.body.input
  if (validateInput) {
    if (typeof userInput !== 'string' || !/^[a-zA-Z0-9]+$/.test(userInput)) {
      return res.status(400).send('Invalid input')
    }
  }
  res.send(`Received input: ${userInput}`)
})

app.listen(3000, () => {
  console.log('Server running on port 3000')
})

Need a hint?

Helmet helps add important security headers automatically.