Common Node.js security vulnerabilities in Node.js - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Express framework safely.

Node.js

const express = require([1]);

Drag options to blanks, or click blank then click option'

A"express"

Bexpress

C'http'

D"fs"

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting quotes around the module name

Using wrong module names

To import Express, you must use the module name as a string: "express".

2fill in blank

medium

Complete the code to parse JSON request bodies securely using Express.

Node.js

app.use(express.[1]());

Drag options to blanks, or click blank then click option'

Atext

Bjson

Cstatic

Durlencoded

Attempts:

3 left

💡 Hint

Common Mistakes

Using urlencoded instead of json

Not using any body parser

Use express.json() middleware to safely parse JSON bodies.

3fill in blank

hard

Fix the error in this code to prevent prototype pollution in user input handling.

Node.js

const safeUser = Object.assign({}, req.body, [1]);

Drag options to blanks, or click blank then click option'

Areq.params

BObject.prototype

Cnull

Dreq.query

Attempts:

3 left

💡 Hint

Common Mistakes

Using Object.prototype causes pollution

Using req.params or req.query instead of null

Using null as the second argument prevents prototype pollution by not copying prototype properties.

4fill in blank

hard

Fill both blanks to safely set HTTP headers to prevent clickjacking and XSS attacks.

Node.js

app.use(helmet.[1]());
app.use(helmet.[2]());

Drag options to blanks, or click blank then click option'

Aframeguard

Bcors

CxssFilter

DcontentSecurityPolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using cors instead of frameguard

Confusing contentSecurityPolicy with xssFilter

helmet.frameguard() helps prevent clickjacking by setting frame options.
helmet.xssFilter() adds protections against cross-site scripting (XSS).

5fill in blank

hard

Fill all three blanks to create a secure password hash using bcrypt.

Node.js

const bcrypt = require('bcrypt');
const saltRounds = [1];
const password = req.body.password;
const hash = await bcrypt.[2](password, [3]);

Drag options to blanks, or click blank then click option'

A10

BhashSync

CsaltRounds

Dcompare

Attempts:

3 left

💡 Hint

Common Mistakes

Using compare instead of hashSync

Passing wrong salt parameter

Use 10 as salt rounds for good security.
hashSync hashes the password synchronously.
Pass saltRounds as the salt parameter.