security-express

Auth Middleware Patterns

Missing Auth on Routes

// No auth on admin routes - MUST NOT do this
app.get('/api/admin/users', async (req, res) => {
  res.json(await User.find());
});

// MUST apply auth middleware
app.get('/api/admin/users', requireAuth, requireAdmin, async (req, res) => {
  res.json(await User.find());
});

Middleware Order Matters

// Wrong order - static files before auth - MUST NOT do this
app.use(express.static('uploads')); // Exposed!
app.use(requireAuth);

// MUST place auth before protected static files
app.use('/public', express.static('public')); // Intentionally public
app.use(requireAuth);
app.use('/uploads', express.static('uploads')); // Now protected

Router-Level Auth Gaps

// SHOULD check: Is auth applied to all routes in admin router?
const adminRouter = express.Router();
adminRouter.use(requireAuth); // Applied to all routes below
adminRouter.get('/users', getUsers);
adminRouter.delete('/users/:id', deleteUser);

// Watch for routes defined BEFORE the middleware
const apiRouter = express.Router();
apiRouter.get('/health', getHealth); // No auth (intentional?)
apiRouter.use(requireAuth);
apiRouter.get('/users', getUsers); // Has auth

Common Vulnerabilities

SQL/NoSQL Injection

// String interpolation - MUST NOT do this
const user = await db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);

// MUST use parameterized query
const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);

// MongoDB injection risk
const user = await User.findOne({ email: req.body.email }); // If email is { $gt: "" }

// MUST validate input type
if (typeof req.body.email !== 'string') return res.status(400).json({ error: 'Invalid email' });

Path Traversal

// User-controlled path - MUST NOT do this
app.get('/files/:filename', (req, res) => {
  res.sendFile(`./uploads/${req.params.filename}`); // ../../etc/passwd
});

// MUST validate and normalize
const path = require('path');
app.get('/files/:filename', (req, res) => {
  const filename = path.basename(req.params.filename);
  const filepath = path.join(__dirname, 'uploads', filename);
  if (!filepath.startsWith(path.join(__dirname, 'uploads'))) {
    return res.status(400).json({ error: 'Invalid path' });
  }
  res.sendFile(filepath);
});

Error Handling

// Stack traces in production - MUST NOT do this
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack }); // Leaks internals
});

// MUST use safe error handler
app.use((err, req, res, next) => {
  console.error(err); // Log for debugging
  res.status(500).json({ error: 'Internal server error' });
});

Session Security

// Insecure session config - MUST NOT do this
app.use(session({
  secret: 'keyboard cat', // Hardcoded!
  cookie: { secure: false }, // No HTTPS requirement
}));

// MUST use secure config
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true, // HTTPS only
    httpOnly: true, // No JS access
    sameSite: 'strict', // CSRF protection
    maxAge: 1000 * 60 * 60 * 24, // 24 hours
  },
}));

Rate Limiting

SHOULD check for rate limiting on auth routes:

const rateLimit = require('express-rate-limit');

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts
  message: 'Too many login attempts',
});

app.post('/api/login', authLimiter, loginHandler);
app.post('/api/register', authLimiter, registerHandler);
app.post('/api/forgot-password', authLimiter, forgotPasswordHandler);