NodeJS Training

NodeJS training project with Express, MongoDB and Mongoose

Security best practices

Compromised database

• Strongly encrypt passwords with salt and hash (bcrypt)
• Strongly encrypt passwords reset tokens (sha256)

Brute force attacks

• Use bcrypt (makes login requests slow)
• Implement rate limiting (express-rate-limit)
• Implement maximum login attempts

XSS attacks

• Store JWT in HTTPOnly cookies
• Sanitize user input data
• Set special HTTP headers (helmet)

Denial of Service (DOS) attack

• Implement rate limiting (express-rate-limit)
• Limit body payload (body-parser)
• Avoid evil regular expressions

NoSQL query injection

• Use mongoose for MongoDB
• Sanitize user input data