Security in Node.js with Express and Angular

Analyze a vulnerable app to reveal how a user auth token is stored in cookies or session storage, enabling an attacker to impersonate the logged-in user.

Demonstrate attack execution by injecting scripts into the search field, including an alert, revealing how cookies and session storage expose a user auth token and enable impersonation via xhr.

Move margins to a separate stylesheet, link styles.css in the HTML, and apply a class such as welcomed-message to manage spacing.

Explore how Angular handles user input to prevent cross-site scripting by contrasting sanitization with escaping, using ng-bind-html versus ng-bind and the strict contextual escaping service to safely render search results.

Defend against cross-site scripting by implementing server-side input handling with the access ss filters module in the node.js routes, demonstrate escaping on both the UI (angular) and server layers.

Implement a content security policy in an express app with the luscum module, enforcing default-src, style-src, img-src to 'self', enabling NGI CSP directive in Angular, and permitting data URLs.

The content security policy implemented with the luscum library blocks inline scripts to mitigate cross-site scripting when input handling with the excesses filters library is disabled.

This lecture shows how Wireshark captures local network traffic, exposing username and password in the login post and cookies via api requests like get api/people.

Generate a self-signed certificate with OpenSSL for local development, creating a 2048-bit RSA key and certificate valid for 365 days to enable transport layer security in an Express server.

Implement https for express server by reading certificate and key with fs, then create an https server using the app. Remove the key passphrase with openssl and rerun the server.

Observe transport layer security in action: a self-signed certificate triggers a 'not private' warning, data becomes encrypted, and traffic is shielded from man in the middle attacks.

Put on attacker hats to explore a vulnerable app, update a profile from Jim Bob to Brian Clark, and inspect the network request to localhost:8001/api/user/profile with the auth token cookie.

Learn how an attacker uses a hidden form and auto-submission to target a vulnerable app, leveraging the user's cookies to modify a profile via a forged request.

Demonstrate a csrf attack by running an attacker app to forge requests that alter a user profile in the vulnerable app, using cookies to impersonate the user.

Implement origin and refer header checks as a middleware mitigation for cross-site request forgery in a Node.js Express app, using a whitelist and 403 errors for invalid headers.

Implement an origin and referer header check middleware in an Express app to mitigate csrf, using a whitelist like https://localhost:8000 and blocking mismatched requests.

Protect against cross-site request forgery by implementing the synchronizer token pattern with express-session and lusca, using Angular's XSRF token cookie to validate header and cookie.

The lecture demonstrates a clickjacking setup against a vulnerable app, using a hidden iframe and a deceptive button to trigger the 'delete all' profile action, from the attacker client.

the lecture demonstrates attack execution by showing how an attacker application uses a hidden iframe to overlay a vulnerable app, revealing a profile deletion action and console logs.

Learn to prevent clickjacking by implementing the x-frame-options header and the content security policy frame-ancestors, using the Luscum module to apply these protections in the vulnerable app.

Explore preventing clickjacking by setting frame-ancestors to same origin and self. A same-origin I-frame test demonstrates protection on the vulnerable app and is then removed.

Explore prevention through limiting framing to specific origins by configuring the X-Frame-Options header and the frame-ancestors directive to allow a demonstration iframe load from a specific attacker domain.