Security in Node.JS Webserver

Question

So, I'm in the middle of learning my way around Node.JS, and so far I'm loving it. I've got a couple projects already at work that I think I can utilize nodejs in.

I'm worried, though, about security. If I write a custom webserver using Node.JS's http module, am I likely to be super vulnerable to attacks? Apache/IIS have had years (and years and years) of professional teams building security into their webservers, and still people continue to find holes.. Is it likely that my homebrewed webserver will be much more open to attack?

What things can I focus on to build a good layer of security into my webserver? Are there any good articles out there that cover the topic?

Answer 1

I agree with anm and schaermu about using a reverse proxy so that your application is not directly accessed by your visitors, even if that really has more to do with stability than security.

I want to add that you also have to think about safely installing the Node itself and its modules. In particular, never install npm using this method:

curl http://npmjs.org/install.sh | sudo sh

This is basically giving root shell to anything that you get from the network using insecure HTTP with no verification at all, not even knowing who are you talking to. This can lead to a serious compromise of your entire system using very basic and widely known methods, and if your system is compromised then it doesn't matter if your application is behind a reverse proxy, firewall or anything. See this answer for a more comprehensive explanation.

• thejh: Nice thoughts, but they don't really help you. As soon as you clone a git repo and run its makefile, you could be infected. As soon as you install just one malicious npm package, you could be infected. Also, as long as your account is able to sudo and you sometimes use it for that, not being root while getting infected has ~zero impact on the attackers abilities to do evil stuff.

Answer 2

The reason why there are years and years of professional teams building security into Apache / IIS is because those are all encompassing servers. They can have all types of services on by default running version X of software that needs to be patched when some hole is found, etc.

One of the great things I find about Node.JS is that you tell it what you want to run on the OS level for your specific application. No middle man layer if you don't want it. All I have to worry about if I host it on a server I administer is OS level ports and the web application code. No Apache config files, module updates, etc.

So when it comes to security in Node.JS worry about scrubbing outside information before acting on it, verify identity on potentially harmful actions, etc. Be as closed as possible. Use SFTP to transfer your files to the remote hosting server and just have the necessary ports open for your web application to function properly.

Answer 3

Try using Nginx as your frontend-webserver to improve both stability and security. Check google for some resources for that topic.

• http://www.shinstudio.com/blog/backend-tech/setting-up-node-js-in-nginx/
• http://dailyjs.com/2010/03/15/hosting-nodejs-apps/

• Purefan: At this point NginX is unable to proxy in Http 1.1, so if you use NodeJS + websockets NginX is not a team player in this case
• jwchang: @Purefan So what would be a choice for in that situation? raw NodeJS http server without nginx?
• Purefan: I believe HAProxy supports http 1.1 for back end servers. But yeah, so far what I've seen is to skip NginX when using socket.io.

Answer 4

You might want to use a reverse proxy.