Node.js Security

  1. Common Web Application Vulnerabilities in Node.js
    1. Injection Attacks
      1. SQL Injection
        1. Understanding SQL Injection Mechanics
          1. Blind SQL Injection
            1. Time-Based SQL Injection
              1. Prevention with Parameterized Queries
                1. ORM Security Best Practices
                  1. Avoiding Dynamic Query Construction
                    1. Input Validation for SQL
                    2. NoSQL Injection
                      1. MongoDB Operator Injection
                        1. JavaScript Injection in NoSQL
                          1. Query Parameter Manipulation
                            1. Sanitization Techniques
                              1. Safe Query Building
                              2. Command Injection
                                1. OS Command Injection Vectors
                                  1. Dangers of child_process.exec
                                    1. Secure Alternatives
                                      1. execFile Usage
                                        1. spawn Implementation
                                        2. Input Validation for System Commands
                                          1. Sandboxing Techniques
                                          2. Code Injection
                                            1. eval() Vulnerabilities
                                              1. new Function() Risks
                                                1. Template Injection
                                                  1. Safe Code Evaluation Alternatives
                                                    1. Sandboxing User Code
                                                    2. LDAP Injection
                                                      1. XPath Injection
                                                      2. Cross-Site Scripting (XSS)
                                                        1. Reflected XSS
                                                          1. Attack Mechanics
                                                            1. Common Sources in Node.js Applications
                                                              1. URL Parameter Exploitation
                                                              2. Stored XSS
                                                                1. Persistent Attack Vectors
                                                                  1. Database Storage Risks
                                                                    1. User-Generated Content Vulnerabilities
                                                                    2. DOM-based XSS
                                                                      1. Client-Side JavaScript Vulnerabilities
                                                                        1. Server-Side Rendering Implications
                                                                          1. Virtual DOM Security
                                                                          2. Mitigation Strategies
                                                                            1. Output Encoding
                                                                              1. HTML Entity Encoding
                                                                                1. JavaScript Encoding
                                                                                  1. URL Encoding
                                                                                    1. CSS Encoding
                                                                                    2. Content Security Policy
                                                                                      1. CSP Directive Configuration
                                                                                        1. Nonce and Hash Usage
                                                                                          1. Monitoring CSP Violations
                                                                                            1. CSP Bypass Prevention
                                                                                            2. Templating Engine Security
                                                                                              1. Auto-Escaping Features
                                                                                                1. Context-Aware Escaping
                                                                                                  1. Avoiding Raw HTML Output
                                                                                              2. Cross-Site Request Forgery (CSRF)
                                                                                                1. CSRF Attack Mechanics
                                                                                                  1. Exploiting User Authentication
                                                                                                    1. Attack Prerequisites
                                                                                                      1. State-Changing Operations
                                                                                                      2. Prevention Techniques
                                                                                                        1. Anti-CSRF Tokens
                                                                                                          1. Synchronizer Token Pattern
                                                                                                            1. Token Generation and Validation
                                                                                                            2. Custom Headers Validation
                                                                                                              1. Origin and Referer Checking
                                                                                                            3. Server-Side Request Forgery (SSRF)
                                                                                                              1. SSRF Attack Vectors
                                                                                                                1. Internal Network Scanning
                                                                                                                  1. Cloud Metadata Service Access
                                                                                                                    1. File System Access via URLs
                                                                                                                    2. Blind SSRF
                                                                                                                      1. Mitigation Strategies
                                                                                                                        1. Input Validation and Whitelisting
                                                                                                                          1. URL Parsing Security
                                                                                                                            1. Restricting Outbound Requests
                                                                                                                              1. Disabling HTTP Redirects
                                                                                                                                1. Network Segmentation
                                                                                                                                  1. DNS Rebinding Protection
                                                                                                                                2. Insecure Deserialization
                                                                                                                                  1. Serialization Fundamentals
                                                                                                                                    1. Object Serialization in JavaScript
                                                                                                                                      1. Common Serialization Formats
                                                                                                                                        1. Use Cases and Risks
                                                                                                                                        2. Deserialization Vulnerabilities
                                                                                                                                          1. Remote Code Execution
                                                                                                                                            1. Data Tampering
                                                                                                                                              1. Object Injection
                                                                                                                                              2. Safe Serialization Practices
                                                                                                                                                1. JSON vs Binary Formats
                                                                                                                                                  1. Schema Validation
                                                                                                                                                    1. Avoiding Custom Deserialization
                                                                                                                                                      1. Integrity Checks
                                                                                                                                                    2. Path Traversal
                                                                                                                                                      1. Directory Traversal Mechanics
                                                                                                                                                        1. Relative Path Exploitation
                                                                                                                                                          1. Absolute Path Manipulation
                                                                                                                                                            1. URL Encoding Bypass
                                                                                                                                                            2. File System API Vulnerabilities
                                                                                                                                                              1. Prevention Techniques
                                                                                                                                                                1. Input Sanitization
                                                                                                                                                                  1. Path Normalization
                                                                                                                                                                    1. Chroot Jails
                                                                                                                                                                      1. File Access Restrictions

                                                                                                                                                                  Previous

                                                                                                                                                                  1. Foundations of Node.js Security

                                                                                                                                                                  Go to top

                                                                                                                                                                  Next

                                                                                                                                                                  3. Dependency and Package Management Security