Bypass few common security attacks to Donut Server #146

kmehant · 2020-07-09T18:39:50Z

Possible attacks

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

kmehant · 2020-07-09T18:41:27Z

@jaskiratsingh2000 @vaibhavdaren @devesh-verma
I am working on these!

kmehant · 2020-07-10T02:54:56Z

We shall add similar fixes to the Donut Frontend too using Nginx

vaibhavdaren

to be added in middleware layer.

…ity headers Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

kmehant

@vaibhavdaren @Rupeshiya @devesh-verma I have added relevant comments explaining my approach.
I have tested it personally, it seems working fine.

kmehant · 2020-07-14T05:34:25Z

.env.dev

+REDIS_HOST="redis"
+REDIS_PORT=6379
+REDIS_PASSWORD="auth"
+REDIS_DB=0


Added Redis connection credentials here

kmehant · 2020-07-14T05:35:36Z

app.js

@@ -5,6 +5,7 @@ const cookieParser = require('cookie-parser')
 const createError = require('http-errors')
 const path = require('path')
 const socket = require('socket.io')
+const helmet = require('helmet')


Using helmet to add few security response headers as it has got standard implementations and widely used in express apps

kmehant · 2020-07-14T05:41:13Z

app.js

+  res.setHeader('Cache-Control', 'no-store')
+  res.setHeader('Expires', 0)


Does not allow browsers to cache Donut server responses, so using will help to bypass attacks such as CSRF.
Anyways we will be having a global cache server such as Redis which we can implement in subsequent PRs.

For csrf attack you can use this, https://www.npmjs.com/package/csrf

@Rupeshiya I will work on csrf there are a couple of things to do 😅 will add them in my next or

kmehant · 2020-07-14T05:41:39Z

app.js

  req.io = io
  next()
 })

+// setting headers for security
+app.disable('x-powered-by')


Hide from attackers on what tech stack does the Donut server runs on.
This will. avoid framework-specific attacks.

@kmehant I think it will only disable express.js to come into view of attackers

kmehant · 2020-07-14T05:42:31Z

app.js

  req.io = io
  next()
 })

+// setting headers for security
+app.disable('x-powered-by')
+app.use(helmet.xssFilter())


Bypasses reflected XSS

kmehant · 2020-07-14T05:54:48Z

app/utils/rateLimit.js

@@ -0,0 +1,67 @@
+


Util for limiting the number of login retries on using email and password

kmehant · 2020-07-14T05:54:59Z

app/utils/rateLimit.js

+const Redis = require('ioredis')
+const { RateLimiterRedis } = require('rate-limiter-flexible')
+
+const redisClient = new Redis({


Connecting to Redis

kmehant · 2020-07-14T05:56:22Z

app/utils/rateLimit.js

+const loginLimiter = new RateLimiterRedis({
+  storeClient: redisClient,
+  keyPrefix: 'login',
+  points: 5,
+  duration: 60 * 30 // 30 minutes wait time
+})


config for rate limiting

duration is the amount of delay after the allowed number of retries
points is number of retries allowed before starting the delay

@kmehant You are rate-limiting only for the login endpoints so DOS attack is still possible by a logged-in user.
Let say I am a logged in user and now I will write a script something like this:

while(1) { setInterval(() => { // hit endpoint to send GET/POST request to the server }, 1000); }

This will hit the server after every 1second and due to infinite hit server will go down.

Please take it into consideration.
cc @vaibhavdaren

@Rupeshiya Yes, this point is noted ✌🏻.
I will create another issue and add these points there and will work on another PR as this change is especially required for login endpoint 😅 to create time block delays.
But the present work is to create restrict unsuccessful login attempts that come under rate-limiting but has a special extension of using block time intervals. (was the reason for not writing this as a middleware rather an extension to login controller)

So in our next pr, I will simply write a middleware that will keep track of the number of requests (immediate) and IP address of the Client, and then we will use a quota system where we will block the user from accessing the service. (this truly comes under rate-limiting 😅 and not the present work, sorry if I have used the word rate-limiting anywhere in the context for the present work.)

Yes!!
Great go ahead @kmehant !!

kmehant · 2020-07-14T05:57:13Z

app/utils/rateLimit.js

+const limiterConsecutiveOutOfLimits = new RateLimiterRedis({
+  storeClient: redisClient,
+  keyPrefix: 'login_consecutive_outoflimits',
+  points: 99999,
+  duration: 0
+})


config for repeating the process of being out of retries

kmehant · 2020-07-14T05:59:15Z

docker-compose.dev.yml

+  redis:
+    container_name: redis
+    image: redis:5-alpine
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-data:/data
+    command: redis-server --requirepass auth


Added Redis to the container setup

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

Rupeshiya · 2020-07-14T14:29:04Z

@kmehant One major attack that can easily exploit the server is DOS attack, So if possible please prevent that. (#146 (comment))

Bypass clickjacking attack

86461c8

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

kmehant marked this pull request as draft July 10, 2020 02:12

kmehant mentioned this pull request Jul 10, 2020

Use nginx for various pruposes with a dedicated configuration codeuino/social-platform-donut-frontend#512

Open

5 tasks

vaibhavdaren requested changes Jul 10, 2020

View reviewed changes

codeuino deleted a comment from kmehant Jul 10, 2020

kmehant added 4 commits July 13, 2020 17:43

Use helmet (to make use of standard implementations) to achieve secur…

a16d679

…ity headers Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

Add redis as data store for rate limiting

b2025ec

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

Add rateLimiting code to bypass brute force attacks for login

b1b001c

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

Add cache control header and fix new line

114655a

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

kmehant marked this pull request as ready for review July 13, 2020 17:32

kmehant requested a review from vaibhavdaren July 13, 2020 17:32

kmehant changed the title ~~[WIP] Bypass few common security attacks to Donut Server~~ Bypass few common security attacks to Donut Server Jul 13, 2020

kmehant commented Jul 14, 2020

View reviewed changes

Removed redundant code

9b73bdc

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

vaibhavdaren added the requires_testing label Jul 14, 2020

Keep redis connection in config folder

7b2a638

Signed-off-by: K mehant <411843@student.nitandhra.ac.in>

kmehant mentioned this pull request Jul 14, 2020

Add security layers to prevent DoS and CSRF attacks to Donut Server #149

Open

vaibhavdaren added the abandoned label Oct 17, 2020

		res.setHeader('Cache-Control', 'no-store')
		res.setHeader('Expires', 0)

Uh oh!

Bypass few common security attacks to Donut Server #146

Are you sure you want to change the base?

Bypass few common security attacks to Donut Server #146

Uh oh!

Conversation

kmehant commented Jul 9, 2020 • edited by devesh-verma Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Possible attacks

Uh oh!

kmehant commented Jul 9, 2020

Uh oh!

kmehant commented Jul 10, 2020

Uh oh!

vaibhavdaren left a comment

Choose a reason for hiding this comment

Uh oh!

kmehant left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Rupeshiya commented Jul 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kmehant commented Jul 9, 2020 •

edited by devesh-verma

Loading

kmehant left a comment •

edited

Loading

Rupeshiya commented Jul 14, 2020 •

edited

Loading