lakshmankashyap

Security - the elephant in the room. Everyone agrees that it is very important but few takes it seriously. We at RisingStack want you to do it right - this is why we have put together this checklist to help you guide through the must have security checks before your application is enabled to thousands of users/customers.

Most of these items are general and applies to all languages and frameworks not just Node.js - however some of the tools presented are Node.js specific. You should also check our introductory Node.js security blogpost.

Configuration Management

Security HTTP Headers

There are some security-related HTTP headers that your site should set. These headers are:

lakshmankashyap

<script type="text/javascript">
function idleTimer() {
    var t;
    //window.onload = resetTimer;
    window.onmousemove = resetTimer; // catches mouse movements
    window.onmousedown = resetTimer; // catches mouse movements
    window.onclick = resetTimer;     // catches mouse clicks
    window.onscroll = resetTimer;    // catches scrolling
    window.onkeypress = resetTimer;  //catches keyboard actions

lakshmankashyap

<script type="text/javascript">
function idleTimer() {
    var t;
    //window.onload = resetTimer;
    window.onmousemove = resetTimer; // catches mouse movements
    window.onmousedown = resetTimer; // catches mouse movements
    window.onclick = resetTimer;     // catches mouse clicks
    window.onscroll = resetTimer;    // catches scrolling
    window.onkeypress = resetTimer;  //catches keyboard actions

lakshmankashyap

// This is from my comment here: http://wolfram.kriesing.de/blog/index.php/2008/javascript-remove-element-from-array/comment-page-2#comment-466561

/*
 * How to delete items from an Array in JavaScript, an exhaustive guide
 */

// DON'T use the delete operator, it leaves a hole in the array:
var arr = [4, 5, 6];
delete arr[1]; // arr now: [4, undefined, 6]

lakshmankashyap

#!/bin/node

// https://github.com/ethereumjs/ethereumjs-wallet
// -> npm install ethereumjs-wallet
var Wallet = require('ethereumjs-wallet');

var privateKey = '-> your private key here <-'; // in hex format
var keystorePassword = '-> your keystore password here <-';

var wallet = Wallet.fromPrivateKey(Buffer.from(privateKey, 'hex'));

lakshmankashyap

/bin/node

// https://github.com/ethereumjs/ethereumjs-wallet
// -> npm install ethereumjs-wallet
var Wallet = require('ethereumjs-wallet');

var privateKey = '-> your private key here <-'; // in hex format
var keystorePassword = '-> your keystore password here <-';

var wallet = Wallet.fromPrivateKey(Buffer.from(privateKey, 'hex'));

lakshmankashyap

var Bitcore = require('bitcore');
var Address = Bitcore.Address;
var HDPrivateKey = Bitcore.HDPrivateKey;

var hdPrivateKey = new HDPrivateKey.fromSeed("bf8e06fd8c0dafbc831933422895ad68c0874439e177f136f8f756b360de94f8");
var hdPublicKey = hdPrivateKey.hdPublicKey;

var address = new Address(hdPublicKey.derive( Math.floor(Date.now() / 1000) ).publicKey);
var derivedAddress = new Address(hdPublicKey.derive( Math.floor(Date.now() / 1000) ).publicKey);

lakshmankashyap

//const argv = require('minimist')(process.argv.slice(2));
const Web3 = require("web3")
let web3 = new Web3(new Web3.providers.HttpProvider("http://localhost:8545"))
console.log(web3)

let bip39 = require("bip39")
let hdkey = require('ethereumjs-wallet/hdkey')
let mnemonic = "weather cancel symptom owner lumber bitter bread butter dice trial shrug glance"
let hdwallet = hdkey.fromMasterSeed(bip39.mnemonicToSeed(mnemonic))
// Set to m/44'/60'/0' for ledger nano s hardware wallet compatibilty

lakshmankashyap

NOTE -

• Remove -h option if you are doing operation on same machine
• Remove -u , -p option if your database don't have username and password

Binary

Import database

mongorestore -h IP:port -d DB_Name -u user_name -p password <input db directory>

lakshmankashyap

# Example of dynamically overriding locale in Sails.js

For instance, if your app allows users to pick their preferred language, you might create a [policy](http://sailsjs.com/documentation/concepts/Policies) which checks for a custom language in the user's session, and if one exists, sets the appropriate locale for use in subsequent policies, controller actions, and views:

```js
// api/policies/localize.js
module.exports = function(req, res, next) {
  // If no user is logged in, continue with the default locale.
  if (!req.session.userId) {return next();}
  // Load the user from the database