Docs
21.2-Secure-Coding
21.2 Secure Coding Practices
Overview
Secure coding is about writing code that is resistant to attacks by design. This section covers techniques for input validation, output encoding, and secure handling of sensitive data.
Input Validation Principles
┌────────────────────────────────────────────────────────────────────────────┐
│ Input Validation Pyramid │
├────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌───────────────┐ │
│ │ Business │ ← Business rules validation │
│ │ Logic │ │
│ └───────┬───────┘ │
│ ┌────────────┴────────────┐ │
│ │ Semantic │ ← Value range, format │
│ │ Validation │ │
│ └────────────┬────────────┘ │
│ ┌─────────────────────┴─────────────────────┐ │
│ │ Syntactic Validation │ ← Type, length │
│ └─────────────────────┬─────────────────────┘ │
│ ┌───────────────────────────────┴───────────────────────────┐ │
│ │ Sanitization Layer │ ← Clean │
│ │ (trim, normalize, encode) │ input │
│ └───────────────────────────────────────────────────────────┘ │
│ │
└────────────────────────────────────────────────────────────────────────────┘
Validation Strategies
Whitelist vs Blacklist
┌────────────────────────────────────────────────────────────────────────────┐
│ Whitelist vs Blacklist Validation │
├─────────────────────────────────┬──────────────────────────────────────────┤
│ Whitelist (Recommended) │ Blacklist (Avoid) │
├─────────────────────────────────┼──────────────────────────────────────────┤
│ ✓ Explicitly allow known good │ ✗ Try to block known bad │
│ ✓ Secure by default │ ✗ Insecure by default │
│ ✓ Easy to maintain │ ✗ Constantly needs updating │
│ ✓ Handles unknown attacks │ ✗ New attacks bypass filters │
├─────────────────────────────────┼──────────────────────────────────────────┤
│ Example: │ Example: │
│ const allowed = ['jpg', 'png']; │ const blocked = ['exe', 'js']; │
│ if (allowed.includes(ext)) │ if (!blocked.includes(ext)) │
└─────────────────────────────────┴──────────────────────────────────────────┘
Input Validation Patterns
// ❌ Blacklist approach - can be bypassed
function validateBlacklist(input) {
const dangerous = ['<script>', 'javascript:', 'onerror'];
return !dangerous.some((d) => input.includes(d));
}
// ✓ Whitelist approach - only allow known good
function validateWhitelist(input, pattern) {
return pattern.test(input);
}
// ✓ Schema validation - define exactly what's allowed
const userSchema = {
username: {
type: 'string',
pattern: /^[a-zA-Z0-9_]{3,20}$/,
required: true,
},
email: {
type: 'string',
pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
required: true,
},
age: {
type: 'number',
min: 13,
max: 120,
},
};
Output Encoding
Context-Specific Encoding
┌────────────────────────────────────────────────────────────────────────────┐
│ Context-Specific Encoding │
├──────────────────┬─────────────────────────────────────────────────────────┤
│ Context │ Encoding Required │
├──────────────────┼─────────────────────────────────────────────────────────┤
│ HTML Body │ HTML Entity encoding (< > &) │
│ HTML Attribute │ HTML Attribute encoding + quote escape │
│ JavaScript │ JavaScript Unicode encoding (\uXXXX) │
│ CSS │ CSS escape sequences (\XX) │
│ URL │ URL encoding (%XX) │
│ JSON │ Proper JSON encoding + context encoding │
└──────────────────┴─────────────────────────────────────────────────────────┘
// Different encoding for different contexts
const encoders = {
// HTML body context
html: (str) =>
str.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>'),
// HTML attribute context
htmlAttr: (str) =>
str
.replace(/&/g, '&')
.replace(/"/g, '"')
.replace(/'/g, ''')
.replace(/</g, '<')
.replace(/>/g, '>'),
// JavaScript string context
js: (str) =>
str
.replace(/\\/g, '\\\\')
.replace(/'/g, "\\'")
.replace(/"/g, '\\"')
.replace(/\n/g, '\\n')
.replace(/\r/g, '\\r'),
// URL component
url: (str) => encodeURIComponent(str),
};
Secure Data Handling
Sensitive Data Flow
┌────────────────────────────────────────────────────────────────────────────┐
│ Sensitive Data Lifecycle │
├────────────────────────────────────────────────────────────────────────────┤
│ │
│ Collection Processing Storage Disposal │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │ HTTPS │───────►│ Memory │──────►│Encrypted│─────►│ Secure │ │
│ │ Only │ │ Only │ │ Storage │ │ Delete │ │
│ │ │ │ No Logs │ │ │ │ │ │
│ └─────────┘ └─────────┘ └─────────┘ └─────────┘ │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ Validate Process Hash/Encrypt Zero Memory │
│ Sanitize In Memory Key Management Delete Files │
│ Minimize No Temp Files Access Control Clear Backups │
│ │
└────────────────────────────────────────────────────────────────────────────┘
Password Handling
Secure Password Requirements
// Password security checklist
const passwordRequirements = {
minLength: 12, // Minimum 12 characters
maxLength: 128, // Reasonable maximum
requireUppercase: true, // At least one uppercase
requireLowercase: true, // At least one lowercase
requireNumbers: true, // At least one number
requireSpecial: true, // At least one special char
preventCommon: true, // Check against common passwords
preventUsername: true, // Can't contain username
preventReuse: 5, // Can't reuse last 5 passwords
};
// Never do this
const bad = {
storeInPlainText: true, // ❌
sendInEmail: true, // ❌
logPasswords: true, // ❌
useReversibleEncryption: true, // ❌
useMD5orSHA1: true, // ❌
};
// Always do this
const good = {
useModernHash: 'bcrypt/argon2', // ✓
useSalt: true, // ✓ (automatic with bcrypt)
useHTTPS: true, // ✓
rateLimit: true, // ✓
implementLockout: true, // ✓
};
Error Handling Security
Secure Error Messages
┌────────────────────────────────────────────────────────────────────────────┐
│ Error Message Security │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ Development │ │
│ │ Detailed errors Stack traces │ │
│ │ Variable contents File paths │ │
│ │ SQL queries Internal architecture │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ Production │ │
│ │ Generic messages only "An error occurred" │ │
│ │ Log details server-side Use error IDs │ │
│ │ Never expose internals Sanitize before display │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │
└────────────────────────────────────────────────────────────────────────────┘
// ❌ Dangerous - reveals internal information
catch (error) {
return res.status(500).json({
error: error.message,
stack: error.stack,
query: sql.query
});
}
// ✓ Secure - log internally, return generic message
catch (error) {
const errorId = generateErrorId();
logger.error({ errorId, error, userId });
return res.status(500).json({
error: 'An unexpected error occurred',
errorId: errorId
});
}
Secure Configuration
Environment-Based Configuration
// Configuration security patterns
const config = {
// ✓ Use environment variables
dbPassword: process.env.DB_PASSWORD,
// ✓ Different settings per environment
debug: process.env.NODE_ENV !== 'production',
// ✓ Secure defaults
sessionTimeout: parseInt(process.env.SESSION_TIMEOUT) || 3600,
// ✓ Validate configuration
validate() {
if (!this.dbPassword) {
throw new Error('DB_PASSWORD must be set');
}
},
};
// Never hardcode secrets
const NEVER = {
apiKey: 'sk_live_1234567890', // ❌
dbPassword: 'password123', // ❌
jwtSecret: 'mysecret', // ❌
};
Secure Communication
API Security
┌────────────────────────────────────────────────────────────────────────────┐
│ API Security Layers │
├────────────────────────────────────────────────────────────────────────────┤
│ │
│ Layer 1: Transport │
│ ├── HTTPS/TLS only │
│ ├── Strong cipher suites │
│ └── Certificate validation │
│ │
│ Layer 2: Authentication │
│ ├── API keys or tokens │
│ ├── JWT with proper validation │
│ └── OAuth 2.0 for third-party │
│ │
│ Layer 3: Authorization │
│ ├── Role-based access control │
│ ├── Resource-level permissions │
│ └── Principle of least privilege │
│ │
│ Layer 4: Input Validation │
│ ├── Schema validation │
│ ├── Type checking │
│ └── Size limits │
│ │
│ Layer 5: Rate Limiting │
│ ├── Per-user limits │
│ ├── Per-endpoint limits │
│ └── Burst protection │
│ │
└────────────────────────────────────────────────────────────────────────────┘
Dependency Security
Managing Third-Party Dependencies
// Security practices for dependencies
const dependencyPractices = {
// Audit regularly
audit: 'npm audit',
// Use lockfiles
lockfile: 'package-lock.json',
// Pin versions or use ranges carefully
versioning: {
pinned: '1.2.3', // Exact version
patch: '~1.2.3', // Patch updates only
minor: '^1.2.3', // Minor updates only
},
// Review before installing
review: [
'Check npm/GitHub for maintenance',
'Review source code for red flags',
'Check download counts and community',
'Verify package authenticity',
],
};
Security Checklist
┌────────────────────────────────────────────────────────────────────────────┐
│ Secure Coding Checklist │
├────────────────────────────────────────────────────────────────────────────┤
│ │
│ Input Handling: │
│ □ Validate all input on server side │
│ □ Use whitelist validation │
│ □ Sanitize before processing │
│ □ Set maximum input lengths │
│ │
│ Output Handling: │
│ □ Encode output based on context │
│ □ Use templating engines with auto-escaping │
│ □ Set proper Content-Type headers │
│ │
│ Authentication: │
│ □ Use strong password hashing (bcrypt/argon2) │
│ □ Implement account lockout │
│ □ Secure password reset flows │
│ □ Use MFA where appropriate │
│ │
│ Session Management: │
│ □ Use secure, HttpOnly cookies │
│ □ Regenerate session ID on login │
│ □ Implement session timeout │
│ │
│ Error Handling: │
│ □ Log errors server-side │
│ □ Return generic error messages │
│ □ Don't expose stack traces │
│ │
│ Data Protection: │
│ □ Encrypt sensitive data at rest │
│ □ Use HTTPS for all traffic │
│ □ Minimize data collection │
│ □ Implement proper access controls │
│ │
└────────────────────────────────────────────────────────────────────────────┘
Key Takeaways
- •Validate all input - Never trust user input
- •Encode all output - Context-aware encoding is essential
- •Use strong cryptography - Modern algorithms, proper key management
- •Secure by default - Fail closed, not open
- •Minimize attack surface - Less code, fewer endpoints
- •Defense in depth - Multiple security layers
- •Keep secrets secret - Proper configuration management
Files in This Section
- •
README.md- This documentation - •
examples.js- Secure coding pattern examples - •
exercises.js- Security implementation exercises