Bypass few common security attacks to Donut Server

.env.dev

@@ -3,4 +3,9 @@ NODE_ENV="development"
 JWT_SECRET="thisismysupersecrettokenjustkidding"
 DATABASE_URL="mongodb://mongo:27017/donut-development"
 SENDGRID_API_KEY='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'
-SOCKET_PORT=8810
+SOCKET_PORT=8810
+REDIS_HOST="redis"
+REDIS_PORT=6379
+REDIS_PASSWORD="auth"
+REDIS_DB=0
+

app.js

@@ -5,6 +5,7 @@ const cookieParser = require('cookie-parser')
 const createError = require('http-errors')
 const path = require('path')
 const socket = require('socket.io')
+const helmet = require('helmet')
 
 const indexRouter = require('./app/routes/index')
 const authRouter = require('./app/routes/auth')
@@ -40,10 +41,33 @@ app.use(express.urlencoded({ extended: false }))
 app.use(cookieParser())
 app.use(express.static(path.join(__dirname, 'public')))
 app.use((req, res, next) => {
+  res.setHeader('Cache-Control', 'no-store')
+  res.setHeader('Expires', 0)
   req.io = io
   next()
 })
 
+// setting headers for security
+app.disable('x-powered-by')
+app.use(helmet.xssFilter())
+app.use(helmet.referrerPolicy({ policy: 'same-origin' }))
+app.use(helmet.noSniff())
+app.use(helmet.frameguard({ action: 'sameorigin' }))
+app.use(helmet.hsts({
+  maxAge: 5184000,
+  includeSubDomains: true
+}))
+app.use(helmet.dnsPrefetchControl())
+app.use(helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    baseUri: ["'self'"]
+    // other sources have to mentioned here
+  },
+  browserSniff: false
+}))
+app.use(helmet.ieNoOpen())
+
 app.use('/notification', notificationRouter)
 app.use('/', indexRouter)
 app.use('/auth', authRouter)

app/controllers/auth.js

@@ -1,18 +1,37 @@
 const User = require('../models/User')
 const HttpStatus = require('http-status-codes')
+const rateLimiter = require('../utils/rateLimit')
 module.exports = {
   authenticateUser: async (req, res, next) => {
     const email = req.body.email
     const password = req.body.password
     try {
-      const user = await User.findByCredentials(email, password)
-      const token = await user.generateAuthToken()
-      res.send({ user: user, token: token })
+      const _state = await rateLimiter.rateLimit(email, false)
+      if (_state === 'admit') {
+        const user = await User.findByCredentials(email, password)
+        const token = await user.generateAuthToken()
+        await rateLimiter.rateLimit(email, true)
+        res.send({ user: user, token: token })
+      } else {
+        res.status(HttpStatus.TOO_MANY_REQUESTS).json({ error: _state })
+        if (process.env.NODE_ENV !== 'production') {
+          console.log('Error', '-', _state)
+        }
+      }
+      await rateLimiter.rateLimit(email, true)
     } catch (error) {
       if (process.env.NODE_ENV !== 'production') {
         console.log(error.name, '-', error.message)
       }
-      res.status(HttpStatus.BAD_REQUEST).json({ error: error.message })
+      const _state = await rateLimiter.rateLimit(email, false)
+      if (_state === 'admit') {
+        res.status(HttpStatus.BAD_REQUEST).json({ error: error.message })
+      } else {
+        res.status(HttpStatus.TOO_MANY_REQUESTS).json({ error: _state })
+        if (process.env.NODE_ENV !== 'production') {
+          console.log('Error', '-', _state)
+        }
+      }
     }
   },
   logout: (req, res, next) => {

app/utils/rateLimit.js

@@ -0,0 +1,61 @@
+
+const Redis = require('../../config/redis')
+const { RateLimiterRedis } = require('rate-limiter-flexible')
+
+const redisClient = Redis.redisClient
+
+const loginLimiter = new RateLimiterRedis({
+  storeClient: redisClient,
+  keyPrefix: 'login',
+  points: 5,
+  duration: 60 * 30 // 30 minutes wait time
+})
+
+const limiterConsecutiveOutOfLimits = new RateLimiterRedis({
+  storeClient: redisClient,
+  keyPrefix: 'login_consecutive_outoflimits',
+  points: 99999,
+  duration: 0
+})
+
+function getFibonacciBlockDurationMinutes (countConsecutiveOutOfLimits) {
+  if (countConsecutiveOutOfLimits <= 1) {
+    return 1
+  }
+
+  return getFibonacciBlockDurationMinutes(countConsecutiveOutOfLimits - 1) + getFibonacciBlockDurationMinutes(countConsecutiveOutOfLimits - 2)
+}
+
+module.exports = {
+  // restrict brute for attacks on login
+  rateLimit: async (email, isLoggedIn) => {
+    const redisUserID = await loginLimiter.get(email)
+    let retrySecs = 0
+    if (isLoggedIn) {
+      await limiterConsecutiveOutOfLimits.delete(email)
+      return ('reset done')
+    }
+    if (redisUserID !== null && redisUserID.remainingPoints <= 0) {
+      retrySecs = Math.round(redisUserID.msBeforeNext / 1000) || 1
+    }
+    if (retrySecs > 0) {
+      return ('Retry after: '.concat(String(retrySecs)))
+    } else {
+      try {
+        const resConsume = await loginLimiter.consume(email)
+        if (resConsume.remainingPoints <= 0) {
+          const resPenalty = await limiterConsecutiveOutOfLimits.penalty(email)
+          await loginLimiter.block(email, 60 * getFibonacciBlockDurationMinutes(resPenalty.consumedPoints))
+        } else {
+          return ('admit')
+        }
+      } catch (rlRejected) {
+        if (rlRejected instanceof Error) {
+          throw rlRejected
+        } else {
+          return ('Too many tries, Retry after'.concat(String(Math.round(rlRejected.msBeforeNext / 1000)) || 1))
+        }
+      }
+    }
+  }
+}

config/redis.js

@@ -0,0 +1,10 @@
+const Redis = require('ioredis')
+const redisClient = new Redis({
+  port: process.env.REDIS_PORT,
+  host: process.env.REDIS_HOST,
+  family: 4,
+  password: process.env.REDIS_PASSWORD,
+  db: process.env.REDIS_DB
+})
+
+exports.redisClient = redisClient

docker-compose.dev.yml

@@ -3,7 +3,7 @@ services:
   server:
     container_name: server
     restart: always
-    expose: 
+    expose:
       - "5000"
     build:
       context: .
@@ -23,5 +23,14 @@ services:
       - db-data:/data/db
     ports:
       - "27017:27017"
+  redis:
+    container_name: redis
+    image: redis:5-alpine
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-data:/data
+    command: redis-server --requirepass auth
 volumes:
   db-data:
+  redis-data:

docker-compose.prod.yml

@@ -3,7 +3,7 @@ services:
   server:
     container_name: server-prod
     restart: always
-    expose: 
+    expose:
       - "5000"
     build:
       context: .
@@ -19,12 +19,25 @@ services:
       - DATABASE_URL="mongodb://mongo:27017/donut-development"
       - SENDGRID_API_KEY='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'
       - SOCKET_PORT=8810
+      - REDIS_HOST="redis"
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD="auth"
+      - REDIS_DB=0
   mongo:
     container_name: mongo
     image: mongo
     volumes:
       - db-data:/data/db
     ports:
       - "27017:27017"
+  redis:
+    container_name: redis
+    image: redis:5-alpine
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-data:/data
+    command: redis-server --requirepass auth
 volumes:
   db-data:
+  redis-data:

package.json

@@ -18,11 +18,14 @@
     "dotenv": "^8.2.0",
     "ejs": "~2.6.1",
     "express": "^4.16.4",
+    "helmet": "^3.23.3",
     "http-status-codes": "^1.4.0",
+    "ioredis": "^4.17.3",
     "jsonwebtoken": "^8.5.1",
     "mongoose": "^5.7.7",
     "morgan": "^1.9.1",
     "multer": "^1.4.2",
+    "rate-limiter-flexible": "^2.1.9",
     "socket.io": "^2.3.0",
     "validator": "^10.11.0"
   },