Jassif Team Institution

எடுத்துக்காட்டு: Express-Validator உடன் உள்ளீட்டு சரிபார்ப்பு

const express = require('express');
const { body, validationResult } = require('express-validator');
const app = express();

app.use(express.json());

// Define validation rules
const userValidationRules = [
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }),
  body('age').isInt({ min: 18 }).toInt(),
  body('name').trim().escape().notEmpty()
];

// Apply validation
app.post('/register', userValidationRules, (req, res) => {
  // Check for validation errors
  const errors = validationResult(req);
  
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }

  // Process validated data
  const { email, password, age, name } = req.body;
  // ... safe to use validated data

  res.status(201).json({ message: 'User registered successfully' });
});

எடுத்துக்காட்டு: SQL ஊசி தடுப்பு

// VULNERABLE - DO NOT USE
function searchUsersUnsafe(name) {
  // Direct string concatenation - VULNERABLE TO INJECTION
  return db.query(`SELECT * FROM users WHERE name LIKE '%${name}%'`);
}

// SAFE - USE THIS APPROACH
function searchUsersSafe(name) {
  // Parameterized query - PROTECTED AGAINST INJECTION
  return db.query('SELECT * FROM users WHERE name LIKE ?', [`%${name}%`]);
}

எடுத்துக்காட்டு: XSS தடுப்பு

const express = require('express');
const app = express();

// VULNERABLE - Direct insertion of user input into HTML
app.get('/unsafe', (req, res) => {
  const userInput = req.query.message || '';
  res.send(`
Your message: ${userInput}
`);
});

// SAFE - Encoding user input
app.get('/safe', (req, res) => {
  const userInput = req.query.message || '';
  
  // Encode HTML special characters
  const safeInput = userInput
    .replace(/&/g, '&')
    .replace(//g, '>')
    .replace(/"/g, '"')
    .replace(/'/g, ''');
  
  res.send(`
Your message: ${safeInput}
`);
});

குறைபாடுகளை சரிபார்க்கிறது

# Check for vulnerable dependencies
npm audit

# Automatically fix vulnerabilities when possible
npm audit fix

# Check for vulnerable dependencies in production only
npm audit --production

# Generate a detailed report
npm audit --json > audit-report.json

எடுத்துக்காட்டு: பாதுகாப்பான கடவுச்சொல் ஹாஷிங்

const crypto = require('crypto');

// Generate a random salt
function generateSalt() {
  return crypto.randomBytes(16).toString('hex');
}

// Hash password with PBKDF2
function hashPassword(password, salt) {
  return crypto.pbkdf2Sync(password, salt, 10000, 64, 'sha512').toString('hex');
}

// Register a new user with secure password storage
function registerUser(username, password) {
  // Generate unique salt for this user
  const salt = generateSalt();
  
  // Hash the password with the salt
  const hashedPassword = hashPassword(password, salt);
  
  // Store username, hashedPassword, and salt in database
  // NEVER store plaintext passwords
  return { username, hashedPassword, salt };
}

// Verify a login attempt
function verifyUser(username, password, storedHash, storedSalt) {
  // Hash the provided password with the stored salt
  const hashedAttempt = hashPassword(password, storedSalt);
  
  // Time-constant comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(hashedAttempt, 'hex'),
    Buffer.from(storedHash, 'hex')
  );
}

எடுத்துக்காட்டு: Helmet.js பயன்படுத்துதல்

const express = require('express');
const helmet = require('helmet');
const app = express();

// Apply all security headers with default settings
app.use(helmet());

// Or customize specific headers
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'", 'trusted-cdn.com']
    }
  },
  // Prevent clickjacking
  frameguard: { action: 'deny' },
  // Strict-Transport-Security
  hsts: { maxAge: 15552000, includeSubDomains: true }
}));

எடுத்துக்காட்டு: Express இல் HTTPS அமைத்தல்

const https = require('https');
const fs = require('fs');
const express = require('express');

const app = express();

// Your Express routes here
app.get('/', (req, res) => {
  res.send('Secure HTTPS Server');
});

// HTTPS configuration
const options = {
  key: fs.readFileSync('path/to/private-key.pem'),
  cert: fs.readFileSync('path/to/certificate.pem'),
  // Modern, secure TLS options
  minVersion: 'TLSv1.2',
  ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256'
};

// Create HTTPS server
https.createServer(options, app).listen(443, () => {
  console.log('HTTPS server running on port 443');
});

எடுத்துக்காட்டு: சூழல் மாறிகள் பயன்படுத்துதல்

// Load environment variables from .env file in development
if (process.env.NODE_ENV !== 'production') {
  require('dotenv').config();
}

// Access environment variables
const dbConnection = {
  host: process.env.DB_HOST,
  username: process.env.DB_USER,
  password: process.env.DB_PASSWORD,
  database: process.env.DB_NAME
};

// Never log sensitive information
console.log('Connected to database:', dbConnection.host);
// DON'T DO THIS: console.log('Database connection:', dbConnection);

# Run a basic audit
npm audit

# Fix vulnerabilities automatically (when possible)
npm audit fix

# Fix vulnerabilities that might require major version updates
npm audit fix --force

எடுத்துக்காட்டு: Express-Rate-Limit உடன் விகித வரம்பு

const express = require('express');
const rateLimit = require('express-rate-limit');
const app = express();

// Basic rate limiter: max 100 requests per 15 minutes per IP
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
  message: 'Too many requests from this IP, please try again after 15 minutes'
});

// Apply rate limiting to all requests
app.use(limiter);

// Or apply to specific routes
const loginLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5, // 5 failed attempts per hour
  message: 'Too many login attempts, please try again after an hour'
});

app.post('/login', loginLimiter, (req, res) => {
  // Login logic here
});

எடுத்துக்காட்டு: csurf உடன் CSRF பாதுகாப்பு

const express = require('express');
const cookieParser = require('cookie-parser');
const csrf = require('csurf');
const app = express();

// Setup middleware
app.use(express.urlencoded({ extended: false }));
app.use(cookieParser());

// Initialize CSRF protection
const csrfProtection = csrf({ cookie: true });

// Form display route with CSRF token
app.get('/form', csrfProtection, (req, res) => {
  res.send(`
    

      
      
      Submit
    
  `);
});

// Form submission route with CSRF validation
app.post('/process', csrfProtection, (req, res) => {
    // If we get here, CSRF token was valid
    res.send('Data processed successfully');
});

// CSRF errors will be caught here
app.use((err, req, res, next) => {
     if (err.code === 'EBADCSRFTOKEN') {
         // Handle CSRF token errors
         res.status(403).send('CSRF token validation failed');
     } else {
         next(err);
     }
});

// package.json example with security-related scripts
{
  "name": "secure-node-app",
  "version": "1.0.0",
  "scripts": {
    "start": "node app.js",
    "test": "jest",
    "lint": "eslint . --ext .js",
    "audit": "npm audit --production --audit-level=high",
    "check-vuln": "npx snyk test",
    "security-check": "npm-run-all --parallel lint audit check-vuln",
    "precommit": "npm run security-check"
  },
  "dependencies": {
    // Production dependencies
  },
  "devDependencies": {
    "eslint": "^8.0.0",
    "eslint-plugin-security": "^1.5.0",
    "jest": "^29.0.0",
    "npm-run-all": "^4.1.5",
    "snyk": "^1.1000.0"
  },
  "husky": {
    "hooks": {
      "pre-commit": "npm run security-check"
    }
  }
}