Node.js Backend Development Bootcamp · 강의

Node.js의 안전한 코딩 관행

Node.js 코드에서 XSS, CSRF 및 SQL 인젝션과 같은 일반적인 취약점을 방지하는 모범 사례를 구현합니다.

Node.js의 안전한 코딩 관행은(는) CoddyKit의 무료 Node.js Backend Development Bootcamp 강의입니다. 이것은 4개 중 2번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 Node.js Backend Development Bootcamp 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. Node.js Backend Development Bootcamp 강의에는 총 4개의 강의가 포함되어 있습니다.

이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.

Why Secure Coding Matters

Welcome! In this lesson, we'll dive into critical secure coding practices for Node.js. Writing secure code is just as important as writing functional code.

Understanding and preventing common vulnerabilities protects your application and your users from malicious attacks.

Data Breaches: Exposed sensitive information.
Service Downtime: Attacks can crash your application.
Reputation Damage: Loss of user trust.

Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is a common web vulnerability where attackers inject malicious scripts (usually JavaScript) into web pages viewed by other users.

When a user's browser loads the affected page, the malicious script executes, potentially stealing cookies, session tokens, or altering page content.

Reflected XSS: Script immediately executed from user input.
Stored XSS: Malicious script saved in database, then served to users.
DOM-based XSS: Vulnerability in client-side code modifying the DOM.

Prevent XSS: Escape Output

The primary defense against XSS is to never trust user input and always escape it before rendering it to HTML.

This means converting characters like <, >, &, and " into their HTML entity equivalents (e.g., <, >). This way, the browser interprets them as text, not executable code.

Try running this example:

function escapeHtml(str) {
  return str
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#039;");
}

const userInput = "<h1>Hello</h1><script>alert('XSS!');</script>";
const safeOutput = escapeHtml(userInput);

console.log("Original Input:\n", userInput);
console.log("\nEscaped Output (safe for HTML):\n", safeOutput);

Prevent XSS: CSP

Beyond escaping, a Content Security Policy (CSP) adds another layer of defense against XSS.

CSP is an HTTP header that tells browsers which dynamic resources (scripts, styles, images) are allowed to load and from where. It can significantly mitigate the impact of XSS attacks by blocking unauthorized script execution.

Example header: Content-Security-Policy: default-src 'self'; script-src 'self' trusted.cdn.com;

SQL Injection Explained

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database.

By injecting malicious SQL code into input fields, an attacker can trick the database into executing unintended commands, such as revealing sensitive data, modifying data, or even deleting tables.

A common example is altering a login query to bypass authentication without knowing the password.

Prevent SQLi: Parameterized Queries

The most effective way to prevent SQL Injection is by using parameterized queries (also known as prepared statements).

Instead of directly embedding user input into the SQL string, you use placeholders for values. The database then treats these placeholders as data, not as executable SQL code, preventing any malicious injection.

ORMs (Object-Relational Mappers) like Mongoose for MongoDB or Sequelize for SQL databases handle this automatically.

/*
  This is a conceptual example for parameterized queries.
  In a real app, you'd use a database driver or ORM (e.g., 'pg' for PostgreSQL).
*/

function executeSafeQuery(dbClient, userId) {
  // Using a placeholder (?) ensures the input is treated as data, not code.
  const query = "SELECT * FROM users WHERE id = ?";
  console.log(`Executing SQL: "${query}" with param: "${userId}"`);
  // In a real scenario, dbClient.query would execute this safely.
}

// Mock database client for demonstration purposes
const mockDbClient = {
  query: (sql, params, callback) => {
    // Simulate actual query execution logic here
    console.log("  (Mock DB: Input handled safely)");
    callback(null, [{ id: params, name: "John Doe" }]);
  }
};

const maliciousUserId = "1 OR 1=1"; // This would be dangerous if not parameterized
const safeUserId = "1";

console.log("Attempting a 'malicious' ID (will be treated as a string value): ");
executeSafeQuery(mockDbClient, maliciousUserId);

console.log("\nAttempting a safe ID: ");
executeSafeQuery(mockDbClient, safeUserId);

Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is an attack that tricks a logged-in user into performing an unintended action on a web application.

Imagine you're logged into your bank. An attacker sends you a malicious link (e.g., in an email). If you click it, the attacker's site can make a request to your bank using your authenticated session, forcing you to transfer money without your knowledge.

The key is that the browser automatically sends your session cookies with the request to the bank's domain.

Prevent CSRF: CSRF Tokens

To prevent CSRF, we use CSRF tokens. A unique, unpredictable token is generated by the server for each user session and embedded in forms or headers.

When the user submits a request, the server verifies if the submitted token matches the one stored in the user's session. If they don't match, the request is rejected.

Since an attacker cannot know or forge this unique token for another user, they cannot trick the user into making a valid request.

/*
  This is a conceptual example for CSRF token handling.
  It is not runnable as a standalone script without a web server (e.g., Express).
*/

// 1. Server generates and stores a token in the user's session:
function generateCsrfToken() {
  // In a real app, use a crypto-secure random string generator.
  return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
}

const userSession = { id: "user123", csrfToken: null };
userSession.csrfToken = generateCsrfToken();
console.log("Server generated CSRF token for user:", userSession.csrfToken);

// 2. Server embeds this token in forms sent to the client:
const formHtml = `<form action="/transfer" method="POST">
  <input type="hidden" name="_csrf" value="${userSession.csrfToken}">
  <input type="number" name="amount">
  <button type="submit">Transfer</button>
</form>`;
console.log("\nForm snippet with token (sent to client):\n", formHtml);

// 3. On submission, the server validates the token:
function validateCsrfToken(submittedToken, sessionToken) {
  return submittedToken === sessionToken;
}

const userSubmittedToken = userSession.csrfToken; // Simulate valid submission
const attackerSubmittedToken = "fake_token_from_attacker";

console.log("\nValidation results:");
console.log("  Valid submission:", validateCsrfToken(userSubmittedToken, userSession.csrfToken));
console.log("  Attacker's submission:", validateCsrfToken(attackerSubmittedToken, userSession.csrfToken));

Other Security Headers

Beyond the core vulnerabilities, several other HTTP security headers can enhance your Node.js application's security:

X-Content-Type-Options: nosniff: Prevents browsers from "sniffing" a response's content type, which can prevent XSS attacks.
X-Frame-Options: DENY: Prevents your site from being embedded in an <iframe>, protecting against clickjacking attacks.
Strict-Transport-Security (HSTS): Forces browsers to only connect to your site using HTTPS, preventing downgrade attacks.

These headers are typically set using middleware in frameworks like Express.js.

Security Vulnerability Check

Which of the following is the most effective defense against SQL Injection attacks?

Secure Coding Recap

Great job! You've learned about crucial secure coding practices in Node.js.

XSS: Prevent by escaping all user-generated content before rendering to HTML, and use CSP.
SQL Injection: Prevent by always using parameterized queries or ORMs.
CSRF: Prevent by implementing CSRF tokens for state-changing requests.
Remember to also use other security headers like X-Content-Type-Options and X-Frame-Options for a more robust defense.

Always assume user input is malicious and validate/sanitize/escape it appropriately!

자주 묻는 질문

“Node.js의 안전한 코딩 관행” 강의는 무료인가요?

네 — “Node.js의 안전한 코딩 관행” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 Node.js Backend Development Bootcamp 강의 전체를 잠금 해제할 수 있습니다. Node.js Backend Development Bootcamp 강의에는 총 4개의 강의가 포함되어 있습니다.

“Node.js의 안전한 코딩 관행”에서 뭘 배우나요?

Node.js 코드에서 XSS, CSRF 및 SQL 인젝션과 같은 일반적인 취약점을 방지하는 모범 사례를 구현합니다. 브라우저에서 직접 실행하는 실습 코드로 Node.js Backend Development Bootcamp을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.

Node.js Backend Development Bootcamp을(를) 시작하는 데 경험이 필요한가요?

사전 경험은 필요하지 않습니다. CoddyKit의 Node.js Backend Development Bootcamp은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 4개 중 2번째 강의입니다.

“Node.js의 안전한 코딩 관행” 강의는 얼마나 걸리나요?

대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.

이 Node.js Backend Development Bootcamp 강의에서 코드를 작성하고 실행할 수 있나요?

네. 모든 Node.js Backend Development Bootcamp 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.

이 강의의 모든 강의

← Node.js Backend Development Bootcamp(으)로 돌아가기