I'm looking for modules that should be added to a Node/Express app that address the general security concerns listed below:

  • Injection Vulnerabilities (JavaScript, SQL, Mongo, HTML)
  • Session fixation and hijacking
  • Cross-Site Vulnerabilities (Scripting, Request Forgery)
  • Mass Assignment
  • insert relevant concern here

Thanks for your help!

----------

Some resources I've found:

Excellent talk (11/2012): http://lanyrd.com/2012/asfws/sxzbm/ (see slides)

ServerFault question (2011-2012): https://serverfault.com/questions/285123/is-node-js-mature-for-enterprise-security

Blog post on topic (9/2012): http://codefol.io/posts/29-Why-Rails-and-not-Sinatra-or-Node-js-

Exploit tester: https://code.google.com/p/skipfish/

Passport Module: https://github.com/jaredhanson/passport

EveryAuth Module: https://github.com/bnoguchi/everyauth

security node.js express
Edit
Report