<\/p>\n
Secure coding is the process of writing highly secure source code, minimizing vulnerabilities to prevent attacks from intruders or hackers, focusing on writing code, and developing applications safely.<\/p>\n
Insecure code is the main source of many security problems in software. Errors in the code can lead to serious problems such as security vulnerabilities<\/span>, intrusions, unauthorized access to data, and even harm to systems and users. Secure coding ensures that applications and systems are written correctly and securely from development to deployment.<\/p>\n Secure coding is an extremely important aspect of software development as it plays an important role in protecting applications and systems from attacks and security vulnerabilities<\/span>. Here are a few reasons why secure coding is important:<\/p>\n In short, secure coding is a core element in protecting applications and systems from attacks and security vulnerabilities<\/span>. It<\/span> ensure<\/span>s<\/span> the security and reliability of the software, and protects user and organization data, while also meeting security requirements and standards.<\/p>\n All input data should be checked by both client and server before performing other tasks.<\/p>\n Failed data validation should be rejected immediately and no further processing is performed. Returns an invalid input message to the user.<\/p>\n Navigation handlers that take data such as GET a file should not be processed directly from user input but should be obtained via a constant such as file_id.<\/span><\/p>\n Below is the Nodejs code using the Express.js framework.<\/p>\n + Correct program<\/strong><\/p>\n In this example, we use the fileId the user sends up to get the file path we want to access. This helps to ensure that we are not directly pulling the filename from the user data, thereby avoiding security issues such as unwanted access holes.<\/p>\n + Wrong program<\/strong><\/p>\n In this example, we used the filename from user-supplied data. This will suffer from security issues such as unwanted access vulnerabilities.<\/p>\n All output data that needs to be encoded can use HTML entity encoding\u00a0to perform data encoding against Cross-site Scripting (XSS) vulnerabilities.<\/p>\n Cleaning removes data related to operating system commands to avoid errors related to Command injection.<\/p>\n Suppress data on display against data SQL queries that help protect against SQL Injection related vulnerabilities.<\/p>\n Below is the Nodejs code using the Express.js framework.<\/p>\n + Correct program<\/strong><\/p>\n In the above code, we used the escape-html library to encode the content of customer.note before putting it into HTML. This ensures that any malicious JavaScript code will be encrypted and displayed as regular, non-executable text.<\/p>\n + Wrong program<\/strong><\/p>\n In the above code, we are returning the customer\u2019s personal information. However, the customer.note variable contains a malicious piece of JavaScript code that will be executed when the browser displays it, causing an XSS attack.<\/p>\n Authentication is required for critical resources that are not publicly accessible. Public resources such as CSS, js, etc. do not need to be authenticated.<\/p>\n Can use the provided authentication mechanisms such as Oauth2 or Google authentication<\/span>, Facebook authentication, etc.<\/p>\n Need to encrypt the password can use the provided reputable library.<\/p>\n When logging in, if the user enters the wrong username or password instead of specifically saying “the user has the wrong username” or “the user has entered the wrong password” just notify that “the user entered the wrong login information” to avoid collecting information from hackers.<\/p>\n An authentication mechanism should be implemented before external systems connect to our system to get data (via API, web service, etc.).<\/p>\n Use HTPP POST for authentication requests and the password shows up as *** unreadable.<\/p>\n It is recommended to use strong passwords for accounts such as having at least one uppercase letter, one lowercase letter, one number, one special character, and at least 8 characters in length.<\/p>\n The password reset link should have a short expiration time.<\/p>\n Need to set up a 2FA authentication mechanism for important tasks.<\/p>\n Set password change frequency and password re-use mechanism.<\/p>\n Request a temporary password change on the first login and set up a mechanism to lock the account after a number of incorrect credentials.<\/p>\n Below is the Nodejs code using the Express.js framework.<\/p>\n + Correct program<\/strong><\/p>\n In the above code:<\/p>\n When a user registers, the password is encrypted before being saved to the database ensuring that the password is not saved as plain text in the database, increasing the security of the application.<\/p>\n When the user logs in, we check the entered password by comparing it with the encrypted password in the database and if the user enters the wrong username or password, we will output the general message \u2018User entered incorrect login information.\u2019 to avoid collecting information from hackers.<\/p>\n + Wrong program<\/strong><\/p>\nWhy is secure coding important?<\/h2>\n
\n
Important principles and methods in secure coding<\/h2>\n
Input Validation<\/h3>\n
const<\/span> express = require<\/span>('express'<\/span>); \r\nconst<\/span> fs = require<\/span>('fs\/promises'<\/span>); \r\nconst<\/span> app = express<\/span>(); \r\nconst<\/span> port = 3000<\/span>;\r\n\r\nenum File { \r\n 1: 'example.txt', \r\n 2: 'example2.txt' \r\n}\r\n\r\n\/\/ Route to get data from file<\/span>\r\napp.get<\/span>('\/file'<\/span>, async<\/span> (req, res) => { \r\n if (isNaN(req.query.fileId)) { \r\n return res.status(400).send('fileId must be a numeric value'); \r\n }\r\n \r\n try<\/span> { \r\n const filePath = `.\/files\/${File[req.query.fileId]}`;<\/span> \r\n \r\n \/\/ Read the contents of the file<\/span>\r\n const<\/span> fileContent = await<\/span> fs.readFile<\/span>(filePath, 'utf-8'<\/span>); \r\n \r\n res.status<\/span>(200<\/span>).send<\/span>(fileContent); \r\n } catch<\/span> (error) { \r\n res.status<\/span>(500<\/span>).send<\/span>('An error occurred while reading the file.'<\/span>); \r\n } \r\n}); \r\n \r\napp.listen<\/span>(port, () =><\/span> { console<\/span>.log<\/span>(`Server running ${port}<\/span>`<\/span>); });<\/pre>\nconst<\/span> express = require<\/span>('express'<\/span>); \r\nconst<\/span> fs = require<\/span>('fs\/promises'<\/span>); \r\nconst<\/span> app = express<\/span>(); \r\nconst<\/span> port = 3000<\/span>; \r\n \r\n\/\/ Route to get data from file<\/span>\r\napp.get<\/span>('\/file'<\/span>, async<\/span> (req, res) => { \r\n try<\/span> { \r\n \/\/ Uses the filename from user input and reads the file's contents<\/span>\r\n const<\/span> fileContent = await<\/span> fs.readFile<\/span>(req.body.fileName, 'utf-8'<\/span>); \r\n \r\n res.status<\/span>(200<\/span>).send<\/span>(fileContent); \r\n } catch<\/span> (error) { \r\n res.status<\/span>(500<\/span>).send<\/span>('An error occurred while reading the file.'<\/span>); \r\n } \r\n}); \r\n \r\napp.listen<\/span>(port, () =><\/span> { console<\/span>.log<\/span>(`Server running ${port}<\/span>`<\/span>); });<\/pre>\nOutput Encoding<\/h3>\n
const<\/span> express = require<\/span>('express'<\/span>); \r\nconst<\/span> escapeHtml = require<\/span>('escape-html'<\/span>);\r\nconst<\/span> app = express<\/span>(); \r\nconst<\/span> port = 3000<\/span>; \r\n \r\napp.get<\/span>('\/customerProfile'<\/span>, (req, res<\/span>) =><\/span> { \r\n const<\/span> customer = { \r\n name<\/span>: \"test\"<\/span>, \r\n note<\/span>: \"<script>alert('XSS attack!');<\/script>\"<\/span> \r\n }; \r\n \r\n const<\/span> encodedCustomerNote = escapeHtml(customer.note);\r\n \r\n res.send<\/span>(` \r\n <h1>Hello, ${customer.name}<\/span>!<\/h1> \r\n <p>${encodedCustomerNote}<\/span><\/p> `\r\n<\/span> ); \r\n}); \r\n \r\napp.listen<\/span>(port, () =><\/span> { console<\/span>.log<\/span>(`Server running ${port}<\/span>`<\/span>); });<\/pre>\nconst<\/span> express = require<\/span>('express'<\/span>); \r\nconst<\/span> app = express<\/span>(); \r\nconst<\/span> port = 3000<\/span>; \r\n\r\napp.get<\/span>('\/customerProfile'<\/span>, (req, res<\/span>) =><\/span> { \r\n const<\/span> customer = { \r\n name<\/span>: \"test\"<\/span>, \r\n note<\/span>: \"<script>alert('XSS attack!');<\/script>\"<\/span> \r\n }; \r\n \r\n res.send<\/span>(` \r\n <h1>Hello, ${customer.name}<\/span>!<\/h1> \r\n <p>${customer.note<\/span>}<\/span><\/p> `\r\n<\/span> ); \r\n}); \r\n \r\napp.listen<\/span>(port, () =><\/span> { console<\/span>.log<\/span>(`Server running ${port}<\/span>`<\/span>); });<\/pre>\nAuthentication and Password Management<\/h3>\n
const<\/span> express = require<\/span>('express'<\/span>); \r\nconst<\/span> bcrypt = require<\/span>('bcrypt'<\/span>); \r\nconst<\/span> app = express<\/span>(); \r\nconst<\/span> port = 3000<\/span>; \r\n \r\n\/\/ Assume this is a database that stores user information<\/span>\r\nconst<\/span> users = []; \r\n \r\napp.use<\/span>(express.json<\/span>()); \r\n \r\n\/\/ User registration<\/span>\r\napp.post<\/span>('\/register'<\/span>, async<\/span> (req, res) => {\r\n const<\/span> { username, password } = req.body<\/span>; \r\n \r\n \/\/ Check if the user already exists<\/span> \r\n if<\/span> (users.find<\/span>(user<\/span> =><\/span> user.username<\/span> === username)) {\r\n return<\/span> res.status<\/span>(400<\/span>).json<\/span>({ error<\/span>: 'User already exists.'<\/span> }); \r\n } \r\n \r\n \/\/ Encrypt password before saving to database<\/span>\r\n const<\/span> hashedPassword = await<\/span> bcrypt.hash<\/span>(password, 10<\/span>); \r\n \r\n \/\/ Save user information to the database<\/span> \r\n users.push<\/span>({ username, password<\/span>: hashedPassword }); \r\n \r\n return<\/span> res.status<\/span>(201<\/span>).json<\/span>({ message<\/span>: 'Sign Up Success.'<\/span> }); \r\n}); \r\n \r\n\/\/ Login<\/span>\r\napp.post<\/span>('\/login'<\/span>, async<\/span> (req, res) => { \r\n const<\/span> { username, password } = req.body<\/span>; \r\n \r\n \/\/ Find users in the database<\/span>\r\n const<\/span> user = users.find<\/span>(user<\/span> =><\/span> user.username<\/span> === username); \r\n if<\/span> (!user) { \r\n return<\/span> res.status<\/span>(401<\/span>).json<\/span>({ error<\/span>: 'User entered incorrect login information.'<\/span> }); \r\n } \r\n \r\n \/\/ Compare encrypted passwords<\/span> \r\n const<\/span> isPasswordValid = await<\/span> bcrypt.compare<\/span>(password, user.password<\/span>); \r\n if<\/span> (!isPasswordValid) { \r\n return<\/span> res.status<\/span>(401<\/span>).json<\/span>({ error<\/span>: 'User entered incorrect login information.'<\/span> }); \r\n } \r\n\r\n return<\/span> res.status<\/span>(200<\/span>).json<\/span>({ message<\/span>: 'Logged in successfully.'<\/span> }); \r\n});\r\n \r\napp.listen<\/span>(port, () =><\/span> { console<\/span>.log<\/span>(`Server running ${port}<\/span>`<\/span>); });<\/pre>\n