OWASP Top 10 Security Checklist (2021)

// Anyone can read any invoice by guessing IDs
app.get('/api/invoices/:id', async (req, res) => {
  const inv = await db.invoices.findById(req.params.id);
  res.json(inv);
});

app.get('/api/invoices/:id', requireAuth, async (req, res) => {
  const inv = await db.invoices.findById(req.params.id);
  if (!inv || inv.ownerId !== req.user.id) {
    return res.status(404).end(); // don't reveal existence
  }
  res.json(inv);
});

import hashlib

def store_password(pw):
    # Fast + unsalted: crackable at billions of guesses/sec
    return hashlib.md5(pw.encode()).hexdigest()

import bcrypt

def store_password(pw):
    return bcrypt.hashpw(pw.encode(), bcrypt.gensalt(rounds=12))

def check_password(pw, stored):
    return bcrypt.checkpw(pw.encode(), stored)

// name = "'; DROP TABLE users;--" becomes part of the SQL
const q = "SELECT * FROM users WHERE name = '"
        + req.query.name + "'";
const rows = await db.query(q);

// Placeholder keeps input as data, never as code
const rows = await db.query(
  'SELECT * FROM users WHERE name = $1',
  [req.query.name]
);

// Unlimited attempts: credential stuffing at full speed
app.post('/login', async (req, res) => {
  const ok = await verify(req.body.email, req.body.password);
  res.json({ ok });
});

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 15 * 60 * 1000,
                            max: 10 });

app.post('/login', limiter, async (req, res) => {
  const ok = await verify(req.body.email, req.body.password);
  res.json({ ok });
});

server {
  listen 80;
  autoindex on;      # directory listing exposed
  server_tokens on;  # version leaked in headers
  add_header Access-Control-Allow-Origin *;
}

server {
  listen 443 ssl;
  autoindex off;
  server_tokens off;
  add_header Strict-Transport-Security "max-age=63072000" always;
  add_header X-Content-Type-Options nosniff always;
  add_header Access-Control-Allow-Origin https://app.example.com always;
}

# Unpinned base + loose install: ships whatever
# CVEs happen to be in "latest" that day
FROM node:latest
COPY . .
RUN npm install
CMD ["node", "server.js"]

FROM node:22.12-alpine3.20
COPY package*.json ./
RUN npm ci --omit=dev && \
    npm audit --audit-level=high
COPY . .
USER node
CMD ["node", "server.js"]

// decode() does NOT verify the signature —
// anyone can forge an admin token
const jwt = require('jsonwebtoken');
app.use((req, res, next) => {
  req.user = jwt.decode(req.cookies.token);
  next();
});

const jwt = require('jsonwebtoken');
app.use((req, res, next) => {
  try {
    req.user = jwt.verify(req.cookies.token,
      process.env.JWT_SECRET,
      { algorithms: ['HS256'], maxAge: '15m' });
    next();
  } catch { res.status(401).end(); }
});

# Runs whatever the remote serves — no verification
steps:
  - name: install tooling
    run: curl -sL https://get.example.com/install.sh | bash

steps:
  - name: install tooling
    run: |
      curl -sLo install.sh https://get.example.com/install.sh
      echo "9f86d081884c7d65...  install.sh" | sha256sum -c -
      bash install.sh

def login(email, pw):
    try:
        return auth(email, pw)
    except AuthError:
        pass  # silent failure: no trail, nothing to alert on

import logging
log = logging.getLogger("auth")

def login(email, pw, ip):
    try:
        return auth(email, pw)
    except AuthError:
        log.warning("login_failed email=%s ip=%s", email, ip)
        raise

// ?url=http://169.254.169.254/latest/meta-data/
// leaks cloud credentials
app.get('/preview', async (req, res) => {
  const r = await fetch(req.query.url);
  res.send(await r.text());
});

const ALLOWED = new Set(['img.example.com', 'cdn.example.com']);
app.get('/preview', async (req, res) => {
  const u = new URL(req.query.url);
  if (u.protocol !== 'https:' || !ALLOWED.has(u.hostname))
    return res.status(400).send('URL not allowed');
  const r = await fetch(u, { redirect: 'error' });
  res.send(await r.text());
});