Book Image

Securing Applications in Node.js [Video]

By : Forbes Lindesay
Book Image

Securing Applications in Node.js [Video]

By: Forbes Lindesay

Overview of this book

<p><span id="description" class="sugar_field">Everyone agrees that web application security is very important but there are very few to take it seriously. There have been lots of high-profile instances of websites having their password databases exposed to the World (e.g. Ashley Madison and Adobe). You don’t want the application you are building to be the next big security horror story. This course will get you up-to-speed on the key attack vectors, quickly covering issues such as cross-site scripting, CSRF, and SQL injection. It will provide you with clear, practical approaches to mitigating these problems. It will show you how to implement OAuth and two-factor authentication for the additional protection of users who need it. Further, we will delve into the critical process of adding secured, well-thought-out authentication and authorization to a Node.js application. After completing this course, you should be confident in your ability to make an application secure with Node.js and keep your data protected.</span></p> <p><span id="description" class="sugar_field">All the code and supporting files for this course are available on Github at <a style="font-weight: normal;" href="https://github.com/PacktPublishing/Securing-Applications-in-Node.js-V-" target="_new">https://github.com/PacktPublishing/Securing-Applications-in-Node.js-V-</a></span></p> <h1>Style and Approach</h1> <p>This course provides step-by-step instructions along with the required implementations showcasing various security issues and ways to mitigate them. The author also highlights some practical examples wherever applicable during the course.</p>
Table of Contents (7 chapters)
Chapter 2
Cross-Site Request Forgery
Content Locked
Section 3
Protecting a Site Using Headers
“Origin” and “referer” (sic) headers offer an easier to use, equally secure option for CSRF protection. Many people are not aware of this alternative, and if they decide that CSRF tokens are too much work, they may abandon CSRF protection entirely. - Explain the concept of “Forbidden Headers” - Explain how “origin” and “referer” (sic) headers let us identify cross origin requests - Use @authentication/csrf middleware as an additional layer of protection against CSRF