แนวทางการเขียนโค้ดที่ปลอดภัยใน Node.js

Welcome! In this lesson, we'll dive into critical secure coding practices for Node.js. Writing secure code is just as important as writing functional code.

Understanding and preventing common vulnerabilities protects your application and your users from malicious attacks.

• Data Breaches: Exposed sensitive information.
• Service Downtime: Attacks can crash your application.
• Reputation Damage: Loss of user trust.

Cross-Site Scripting (XSS) is a common web vulnerability where attackers inject malicious scripts (usually JavaScript) into web pages viewed by other users.

When a user's browser loads the affected page, the malicious script executes, potentially stealing cookies, session tokens, or altering page content.

• Reflected XSS: Script immediately executed from user input.
• Stored XSS: Malicious script saved in database, then served to users.
• DOM-based XSS: Vulnerability in client-side code modifying the DOM.

The primary defense against XSS is to never trust user input and always escape it before rendering it to HTML.

This means converting characters like <, >, &, and " into their HTML entity equivalents (e.g., <, >). This way, the browser interprets them as text, not executable code.

Try running this example:

Beyond escaping, a Content Security Policy (CSP) adds another layer of defense against XSS.

CSP is an HTTP header that tells browsers which dynamic resources (scripts, styles, images) are allowed to load and from where. It can significantly mitigate the impact of XSS attacks by blocking unauthorized script execution.

Example header: Content-Security-Policy: default-src 'self'; script-src 'self' trusted.cdn.com;

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database.

By injecting malicious SQL code into input fields, an attacker can trick the database into executing unintended commands, such as revealing sensitive data, modifying data, or even deleting tables.

A common example is altering a login query to bypass authentication without knowing the password.

The most effective way to prevent SQL Injection is by using parameterized queries (also known as prepared statements).

Instead of directly embedding user input into the SQL string, you use placeholders for values. The database then treats these placeholders as data, not as executable SQL code, preventing any malicious injection.

ORMs (Object-Relational Mappers) like Mongoose for MongoDB or Sequelize for SQL databases handle this automatically.

Cross-Site Request Forgery (CSRF) is an attack that tricks a logged-in user into performing an unintended action on a web application.

Imagine you're logged into your bank. An attacker sends you a malicious link (e.g., in an email). If you click it, the attacker's site can make a request to your bank using your authenticated session, forcing you to transfer money without your knowledge.

The key is that the browser automatically sends your session cookies with the request to the bank's domain.

To prevent CSRF, we use CSRF tokens. A unique, unpredictable token is generated by the server for each user session and embedded in forms or headers.

When the user submits a request, the server verifies if the submitted token matches the one stored in the user's session. If they don't match, the request is rejected.

Since an attacker cannot know or forge this unique token for another user, they cannot trick the user into making a valid request.

Beyond the core vulnerabilities, several other HTTP security headers can enhance your Node.js application's security:

• X-Content-Type-Options: nosniff: Prevents browsers from "sniffing" a response's content type, which can prevent XSS attacks.
• X-Frame-Options: DENY: Prevents your site from being embedded in an <iframe>, protecting against clickjacking attacks.
• Strict-Transport-Security (HSTS): Forces browsers to only connect to your site using HTTPS, preventing downgrade attacks.

These headers are typically set using middleware in frameworks like Express.js.

Great job! You've learned about crucial secure coding practices in Node.js.

• XSS: Prevent by escaping all user-generated content before rendering to HTML, and use CSP.
• SQL Injection: Prevent by always using parameterized queries or ORMs.
• CSRF: Prevent by implementing CSRF tokens for state-changing requests.
• Remember to also use other security headers like X-Content-Type-Options and X-Frame-Options for a more robust defense.

Always assume user input is malicious and validate/sanitize/escape it appropriately!