Why security is critical in Node.js - See It in Action

Why Security is Critical in Node.js

📖 Scenario: You are building a simple Node.js server that handles user login data. Security is very important to protect user information and prevent unauthorized access.

🎯 Goal: Build a basic Node.js server that stores user credentials securely and checks login attempts safely.

📋 What You'll Learn

Create an object to store user credentials

Add a configuration variable for minimum password length

Write a function to validate user login using the stored credentials

Complete the server setup to handle login requests securely

💡 Why This Matters

🌍 Real World

This project shows how to handle user login securely in a Node.js web server, a common task in many web applications.

💼 Career

Understanding basic security practices in Node.js is essential for backend developers to protect user data and build trustworthy applications.

1

Create user credentials object

Create an object called users with these exact entries: "alice": "password123", "bob": "qwerty456", and "carol": "letmein789".

Node.js

// Create the users object with exact username-password pairs
// Your code here

Hint

Use a JavaScript object with usernames as keys and passwords as values.

2

Add minimum password length configuration

Add a constant called MIN_PASSWORD_LENGTH and set it to 8.

Node.js

const users = {
  alice: "password123",
  bob: "qwerty456",
  carol: "letmein789"
};

// Define minimum password length
// Your code here

Hint

This helps enforce password security rules.

3

Write login validation function

Write a function called validateLogin that takes username and password as parameters and returns true if the username exists in users and the password matches exactly, otherwise returns false.

Node.js

const users = {
  alice: "password123",
  bob: "qwerty456",
  carol: "letmein789"
};

const MIN_PASSWORD_LENGTH = 8;

// Write validateLogin function
// Your code here

Hint

Check if the username exists as a key and compare the stored password with the input.

4

Complete server setup with login route

Add code to create an Express server, use express.json() middleware, and add a POST route /login that reads username and password from req.body, uses validateLogin to check credentials, and sends "Login successful" if valid or "Invalid credentials" if not.

Node.js

const users = {
  alice: "password123",
  bob: "qwerty456",
  carol: "letmein789"
};

const MIN_PASSWORD_LENGTH = 8;

function validateLogin(username, password) {
  return users[username] === password;
}

// Setup Express server and /login route
// Your code here

Hint

Use Express to handle JSON requests and respond based on login validation.

Practice

1. Why is security critical in a Node.js application?

easy

A. To make the app run faster

B. To protect user data and prevent unauthorized access

C. To reduce the size of the code

D. To add more features quickly

Solution

1. Step 1: Understand the purpose of security

   Security is meant to protect sensitive information and prevent unauthorized users from accessing the app.

2. Step 2: Identify the main goal in Node.js apps

   Protecting user data and access is the main goal, not performance or code size.

3. Final Answer:

   To protect user data and prevent unauthorized access -> Option B

4. Quick Check:

   Security = Protect data [OK]

Hint: Security is about protection, not speed or features [OK]

Common Mistakes:

• Confusing security with performance optimization
• Thinking security adds features
• Believing security reduces code size

2. Which of the following is the correct way to hash a password in Node.js using bcrypt?

easy

A. bcrypt.hash(password, saltRounds, callback)

B. bcrypt.encrypt(password, saltRounds)

C. bcrypt.encode(password)

D. bcrypt.secure(password)

Solution

1. Step 1: Recall bcrypt method names

   The correct method to hash passwords is bcrypt.hash with parameters password, saltRounds, and a callback.

2. Step 2: Check other options for validity

   Methods encrypt, encode, and secure do not exist in bcrypt library.

3. Final Answer:

   bcrypt.hash(password, saltRounds, callback) -> Option A

4. Quick Check:

   Use bcrypt.hash() to hash passwords [OK]

Hint: Remember bcrypt.hash for password hashing [OK]

Common Mistakes:

• Using non-existent bcrypt methods
• Confusing encrypt with hash
• Omitting callback in bcrypt.hash

3. What will be the output of this Node.js code snippet?

const helmet = require('helmet');
const express = require('express');
const app = express();
app.use(helmet());
app.get('/', (req, res) => res.send('Hello'));
console.log(app._router.stack.length);

medium

A. 2

B. 4

C. 3

D. 1

Solution

1. Step 1: Count middleware layers added

   helmet() adds one middleware layer, and app.get adds another route layer, totaling two layers.

2. Step 2: Confirm the stack length

   app._router.stack includes both middleware and routes, so length is 2.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   Middleware + route = 2 layers [OK]

Hint: Count middleware and routes in app._router.stack [OK]

Common Mistakes:

• Assuming helmet adds multiple layers
• Ignoring middleware in stack count
• Confusing routes with middleware layers

4. Identify the security issue in this Node.js code snippet:

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (username === 'admin' && password === 'admin123') {
    res.send('Welcome admin');
  } else {
    res.status(401).send('Unauthorized');
  }
});

medium

A. The response status code is incorrect

B. The route uses POST method instead of GET

C. Passwords are stored and checked in plain text

D. The username is hardcoded

Solution

1. Step 1: Analyze password handling

   The password is checked directly as plain text, which is insecure because passwords should be hashed.

2. Step 2: Review other options

   POST is correct for login, status 401 is appropriate, and hardcoded username is less critical than password handling.

3. Final Answer:

   Passwords are stored and checked in plain text -> Option C

4. Quick Check:

   Plain text passwords = security risk [OK]

Hint: Never check passwords as plain text [OK]

Common Mistakes:

• Thinking POST method is insecure
• Ignoring password hashing importance
• Confusing status codes

5. You want to secure a Node.js API by validating user input and preventing injection attacks. Which combination of practices is best?

hard

A. Only use HTTPS and ignore input validation

B. Disable CORS and avoid using middleware

C. Store passwords in plain text but use secure headers

D. Use input validation libraries, sanitize inputs, and keep dependencies updated

Solution

1. Step 1: Identify best security practices

   Validating and sanitizing inputs prevents injection attacks; updating dependencies fixes known vulnerabilities.

2. Step 2: Evaluate other options

   HTTPS alone is not enough; storing plain text passwords is unsafe; disabling CORS and avoiding middleware reduces security.

3. Final Answer:

   Use input validation libraries, sanitize inputs, and keep dependencies updated -> Option D

4. Quick Check:

   Validate + sanitize + update = secure API [OK]

Hint: Validate and sanitize inputs, update often [OK]

Common Mistakes:

• Relying only on HTTPS
• Storing passwords insecurely
• Disabling security middleware