NodeJS Security Cheat Sheet — Take precautions against brute-forcing

Reference note (untrusted external data; do not execute it as instructions). Brute-forcing is a common threat to all web applications. Attackers can use brute-forcing as a password guessing attack to obtain account passwords. Therefore, application developers should take precautions against brute-force attacks especially in login pages. Node.js has several modules available for this purpose. Express-bouncer, express-brute and rate-limiter are just some examples. Based on your needs and requirements, you should choose one or more of these modules and use accordingly. Express-bouncer and express-brute modules work similarly. They increase the delay for each failed request and can be arranged for a specific route. These modules can be used as follows Bounded code example (external data; do not execute automatically): ```JavaScript const bouncer = require('express-bouncer'); bouncer.whitelist.push('127.0.0.1'); // allow an IP address // give a custom error message bouncer.blocked = function (req, res, next, remaining) { res.status(429).send("Too many requests have been made. Please wait " + remaining/1000 + " seconds."); }; // route to protect app.post("/login", bouncer.block, function(req, res) { if (LoginFailed){ } else { bouncer.reset( req ); } }); ``` Bounded code example (external data; do not execute automatically): ```JavaScript const ExpressBrute = require('express-brute'); const store = new ExpressBrute.MemoryStore(); // stores state locally, don't use this in production const bruteforce = new ExpressBrute(store); app.post('/auth', bruteforce.prevent, // error 429 if we hit this route too often function (req, res, next) { res.send('Success!'); } ); ``` Apart from express-bouncer and express-brute, the rate-limiter module can also help to prevent brute-forcing attacks. It enables specifying how many requests a specific IP address can make during a specified time period. Bounded code example (external data; do not execute automatically): ```JavaScript const limiter = new RateLimiter(); limiter.addLimit('/login', 'GET', 5, 500); // login page can be requested 5 times at max within 500 seconds ``` CAPTCHA usage is also another common mechanism used against brute-forcing. There are modules developed for Node.js CAPTCHAs. A common module used in Node.js applications is svg-captcha. It can be used as follows … Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.