Node.js, one of the leading JavaScript runtime, is capturing market share gradually.
When anything becomes popular in technologies, they are exposed to millions of professional, including security experts, attackers, hackers, etc.
A node.js core is secure, but when you install third-party packages, the way you configure, install and deploy may require additional security to protect web applications from the hacker. To get an idea, 83% of Snyk users found one or more vulnerabilities in their application. Snyk is one of the popular node.js security scanning platforms.
And another latest research shows ~14% of the whole npm ecosystem was affected.
In my previous article, I mentioned how to find security vulnerabilities in a Node.js application, and many of you asked about remediating/securing them.
So here you go…
Sqreen
Get it started in less than 5 minutes, Sqreen is deployed within your code to protect your application and users from intrusions, attacker.
Sqreen is a lightweight agent built for performance to provide complete security, including the following.
- SQL/No-SQL/Code/Command injections
- Owasp Top 10
- Cross-site scripting attacks
- Zero-day attacks
Not just Node.js, but it supports Python, Ruby, PHP as well.
Sqreen uses collective intelligence to detect an early attack by taking advantage of data coming from other applications.
Snyk
Snyk can be integrated into GitHub, Jenkins, Circle CI, Tarvis, Code Ship, Bamboo to find and fixes the known vulnerabilities.
You can gain visibility of your application dependencies and monitor real-time alerts when risk is found in your code.
On a high-level, Snyk provides complete security protection, including the following.
- Finding vulnerabilities in the code
- Monitor code in real-time
- Fix the vulnerable dependencies
- Get notified when new weakness impact your application
- Collaborate with your team members
Snyk maintains its own vulnerabilities database, and currently, it supports Node.js, Ruby, Scala, and Python.
Templarbit
Templarbit support integration with Node.js, Django, Ruby on Rails, Nginx to protect from application attacks.
It focuses on protecting from the following.
- Clickjacking attacks
- Injection attacks
- Cross-site scripting attacks
- Sensitive data exposure
- Account takeover
- Layer 7 DDoS
You can create custom rules with the smart action to execute for advanced protection. This could be like if frequent login failure is detected, then block IP and send an email.
Cloudflare WAF
Cloudflare WAF (Web Application Firewall) protect your web applications from the cloud (network edge). You don’t have to install anything in your node application.
There are three types of WAF rules you get.
- OWASP – to protect an application from OWASP top 10 vulnerabilities
- Custom rules – you can define the rule
- Cloudflare specials – Rules defined by Cloudflare based on application.
By utilizing Cloudflare, you don’t add security to your site but also take advantage of their fast CDN for better content delivery.
Cloudflare WAF is available in the Pro plan, which costs $20 per month.
Another cloud-based security provider option would be SUCURI, a complete site security solution to protect from DDoS, malware, known vulnerabilities, etc.
Jscrambler
Jscrambler takes an interesting, unique approach to provide code & web page integrity on the client-side.
Jscrambler makes your web application self-defensive to fight with fraud, avoid code modification in run-time, data leakage, and protect from reputational loss and business.
Another exciting feature is application logic, and data is transformed in such a way that it’s hard to understand and hidden on the client-side. This makes it difficult to guess the algorithm, technologies used in the application.
Some of the Jscrambler featured include the following.
- Real-time detection, notification & protection
- Protection from code-injection, DOM-tampering, man-in-the-browser, bots, zero-day attacks
- Credential, credit card, private data loss prevention
- Malware injection prevention
So go ahead and give a try to make your JavaScript application bullet-proof.
Lusca
Lusca is a security module for express to provide OWASP best practices secure header.
Another option would be Helmet to implement headers like CSP, HPKP, HSTS, NoSniff, XSS, DNS Prefetch, etc.
Rate Limit Flexible
Use this tiny package to limit the rate and trigger a function on the event. This will be handy to protect from DDoS and brute force attacks.
Some of the use cases would be as below.
- Login endpoint protection
- Crawler/bot rate limiting
- In-memory block strategy
- Dynamic block based on user’s action
- Rate limiting by IP
- Block too many login attempts
Wondering if this will slow the application?
No, you won’t even notice that. Its fast, the average request adds 0.7ms in the cluster environment.
N|Solid
N|Solid is a platform to run a mission criticial Node.js application.
It got inbuilt real-time vulnerability scanning and custom security policies for enhanced application security. You can configure to get alerted when a new security vulnerability is detected in your Nodejs applications.
CSURF
Add CSRF protection by implementing csurf. It requires a session middleware or cookie-parser to be initialized first.
Intrinsic
Protect from malicious code and zero-day attacks.
Intrinsic works on least privileges philosophy, which makes sense. To get it started, you just need to include their libraries and write the policies for your application security. You can write a policy in JavaScript DSL.
Good news if you are using Serverless functions, it supports AWS Lambda, Azure Functions, and Google Cloud Functions.
Conclusion
I hope the above list of security protection helps you to secure your NodeJS application. It is not specific to Nodejs, but you may also want to try StackPath WAF to protect your entire application from online threats and DDoS attacks.
