Share

If you haven’t checked out the first two-part of our ‘Securing your Applications in Node.js’ series, click here and the second part here.

This is a 3-part blog series on Node.js. This article aims to establish a Node.js security roadmap by addressing security challenges comprehensively and consistently for large infrastructures.

• Part One: About Node.js, What does NodeSource do?, Understanding How Node.js Works, Understanding How N|Solid Works.
• Part Two: Security Principles & N|Solid Security
• Part Three: TIPS AND TRICKS on security in Node.js, Node.js Security in Architecture, Node.js Security in Development, Node.js Security in Deployment.

Let’s begin! 🚀

TIPS AND TRICKS on security in Node.js:

One of the advantages of Node.js is installing additional modules, which provides more opportunities to open back doors from a security point of view. Additionally, the more popular the framework, the more chances hackers will try to find vulnerabilities. Therefore, you should always take Node.js security seriously.

We have collected some practices in conversations with our engineers according to the development stages of the applications in Node.js. We will start with the architecture stage because from the conception and conformation of our project, we must think holistically about security.

Node.js Security — Architecture

The best way to start designing your application is never to leave the ‘Emerald Rule’ aside, this step may seem obvious, but a good design of your application can make a difference. Always think from the beginning about security and scalability. The modular mindset in software design will help you understand the parts and their relationships to create the best experience both from the technical point of view and the user.

https://kinsta.com/ (2021). Nodejs-Architecture [Image]. Kinzta - https://nsrc.io/3b7yLyH

The main objective of any Node.js project structure is to help you:

• Write clean and readable code
• Write reusable pieces of code across our application
• Avoid repetition

__Create new features without disrupting existing code __

The simple rules to follow in architecture will be:

1. Create a folder structure for your project 🗂
2. Separate business logic and API routes 🧳
3. Use a service layer 🧁

4. Use a config folder for configuration files ⚙️
5. Create a scripts folder especially for long npm scripts 📜
6. Use dependency injection 💉

Node.js Security — Development

We can also implement unit testing for our project when you have dependency injection under your belt. Testing is a critical stage in developing our applications. The whole flow of the project — not just the final result — depends on it since buggy code would slow down the development process and cause other problems.

Good practices for the development of your application to keep in mind, always thinking about security are:

1. Testing all the time 🧪
2. Use another layer for third-party services calls 🎉
3. Use the proper tools 🛠️
4. Use a style guide 💅
5. Test your code 👩‍💻
6. Comment your code 📝
7. Keep an eye on your file sizes 👀
8. Use gzip compression 🗜️
9. Use promises 🤝
10. Use promises’ error handling support ⚠️

Node.js Security — Deployment

Deployment is no different, we are getting closer to serving our application to the end-user, and we must not lower our guard. It will be time to review our application and review the best practices implemented and the perfect opportunity to use an APM to help us improve the performance and security of our application in Node.js. An excellent opportunity to try [N|Solid]

At Nodesource, we use the CI/CD method to develop our product; this consists of introducing automation to each of the stages of code development, from testing and static analysis of the code to delivery and deployment. Therefore, we can divide our tips into continuous integration and continuous delivery/deployment. If you want to know more about these concepts, we recommend you to read this documentation.

__Continuous Integration: __

1. Run automatic vulnerability scanning
2. Use security linters
3. Discovering errors early to reduce downtime
4. Lock dependencies 🔑
5. Examine for vulnerable dependencies

__Continuous Delivery / Deployment: __

1. Avoid secrets in config files
2. Don’t run Node.js as root
3. Protect and observe your Node.js apps in production
4. Ensure error management best practices are met 🚨
5. Tick the obvious security boxes ✅

• Create a private network (VPC, VPN) to SSH within your systems
• SSL/TLS
• Avoiding SQL injection attacks
• Use stored procedures or parameterized queries
• HTTP headers and using cookies securely.

Finally, we wish you luck and manage to navigate the world of Nodejs. If you have questions, you can contact us at info@nodesource.com or through this form. ; we will be happy to support your Node.js Journey! 💚

Other Resources

• Learn Node.js by nodejs.dev
• Differences between Node.js and the Browser by nodejs.dev
• Node.js Security Best Practices by Sqreen
• 14 Best Practices to make your node.js application secure by bacancytechnology