Securing Angular and Node.js Apps in Azure
- 1. Securing Angular and Node.js Apps in Azure Brian Clark _clarkio
- 11. O W A S P
- 13. Access Control
- 14. Authenticatio n Authorization You are who you say you are You have the required permissions for the request
- 15. Browser http://insecureheroes.com Server http://insecureheroes.com
- 16. Browser http://insecureheroes.com Server http://insecureheroes.com
- 17. Browser http://insecureheroes.com Server http://insecureheroes.com
- 20. Demo
- 21. Malicious Input
- 23. An attack that injects malicious code into a trusted web site such that it may be executed unintendedly by other users Cross-site Scripting (XSS)
- 24. Prevention Content Security PolicyInput Handling Control what resources the browser is allowed to load Ensure data is aligned with the expectations for its intended use
- 25. Input Handling
- 26. Input Handling
- 28. Sanitization EscapingValidation Ensure the data is legit Invalid Email Result :
- 29. Validation EscapingSanitization Clean the bad data BC Result :
- 30. SanitizationValidation Escaping Encode the bad data B<script>alert(1);</script>C Result :
- 31. Do not trust user input
- 32. Where should we apply input handlers?
- 33. Where should we apply input handlers? Client? Server?
- 34. Browser http://insecureheroes.com Server http://insecureheroes.com
- 38. Both
- 43. ?
- 46. Demo
- 48. <script>var x = “yz”;</script> Content Security Policy Content-Security-Policy: default-src 'self ' Describes sources types in directives (css, image, etc.) <div style=“{margin-top:10px;}”> 1 3 4 2
- 51. Faking Requests
- 55. Demo
- 56. An attack that executes a request on behalf of another authenticated user that was not intending to perform that action being requested Cross-site Request Forgery
- 57. Synchronizer Token Pattern Random token Unique to user and session Included as a header Validated server- side
- 61. Demo
- 63. Stealing Clicks
- 64. Demo
- 65. An attack that tricks users into clicking on content that they were not intending to click on Clickjacking
- 71. Demo
- 76. Demo
- 77. Summary Access Control Faking Requests Stealing Clicks Package Management Malicious Input
- 78. © DEVintersection 2017. All rights reserved. https://www.DEVintersection.com References https://owasp.org https://github.com/Azure-Samples/angular-cosmosdb (branch: insecure-heroes) https://angular.io/guide/security https://www.npmjs.com/package/csurf https://angular.io/guide/http#security-xsrf-protection https://www.npmjs.com/package/helmet https://nodesecurity.io/opensource https://snyk.io
- 79. © DEVintersection 2017. All rights reserved. https://www.DEVintersection.com Please use EventsXD to fill out a session evaluation. Thank you! Brian Clark _clarkio
Editor's Notes
- #5: Mountain Icon credit: http://kreavi.com/royyanwijaya Mountain Icon Source: https://www.iconfinder.com/icons/1664206/climb_climbing_mountain_nature_rock_stone_icon#size=128
- #6: Mountain Icon credit: http://kreavi.com/royyanwijaya Mountain Icon Source: https://www.iconfinder.com/icons/1664206/climb_climbing_mountain_nature_rock_stone_icon#size=128 Boat Icon credit: https://chihabjraoui.com/ Boat Icon Source: https://www.iconfinder.com/icons/1308361/boat_solid_tourism_travel_icon#size=128
- #7: Mountain Icon credit: http://kreavi.com/royyanwijaya Mountain Icon Source: https://www.iconfinder.com/icons/1664206/climb_climbing_mountain_nature_rock_stone_icon#size=128 Boat Icon credit: https://chihabjraoui.com/ Boat Icon Source: https://www.iconfinder.com/icons/1308361/boat_solid_tourism_travel_icon#size=128
- #8: Mountain Icon credit: http://kreavi.com/royyanwijaya Mountain Icon Source: https://www.iconfinder.com/icons/1664206/climb_climbing_mountain_nature_rock_stone_icon#size=128 Boat Icon credit: https://chihabjraoui.com/ Boat Icon Source: https://www.iconfinder.com/icons/1308361/boat_solid_tourism_travel_icon#size=128
- #68: Instruct the browser to turn on security measures Helmet.js (available for Node.js and simple set up) Example headers: XSS-Protection, Frame-Options, HSTS https://helmetjs.github.io/ Mention nsp how it alerts of packages with vulns https://nodesecurity.io/opensource