DEV Community: Yang Li

We're open now. Drape Fit is no longer available...

Yang Li — Fri, 11 Aug 2023 14:00:33 +0000

I'd like to make some of my private ex-projects public now.

😱 How? Why?

📌 drapefit-new-trial-mern

New version TRIAL of Drape Fit Web App using MERN

ATTENTION! - Do not TRUST this deprecated styling service anymore!!!

I hope this archived project source would be helpful to whom want to learn `MERN` at production level...

System Architecture Diagram

Pre-requisites

current release: v0.1.5
latest working: v0.1.6

node.js version: ^18.12.0
mongodb version: ^6.0.4
yarn version: ^1.22.4

Please refer to the scripts part of ./package.json file:

  "scripts": {
    "backend": "node --max-old-space-size=4096 backend/server.js",
    "backend:hotdev": "nodemon --max-old-space-size=4096 backend/server.js",
    "client": "npm start --prefix frontend",
    "dev": "concurrently \"npm run backend:hotdev\" \"npm run client\"",
    "test:server_mocha": "mocha -r esm backend/app.test.js --exit",
    "test:client_jest": "npm run test --prefix frontend",
    "test:c8": "npx c8 node backend/app.js",
    "test:c8_report": "npx c8 report && start \"\" \"coverage/index.html\"",
    "client:build": "npm run build --prefix frontend",
    "server:local": "npm run client:build && node --max-old-space-size=4096 backend/server.js",
    "server:ec2_dev": "pm2 start ecosystem.config.js --node-args=\"--experimental-loader newrelic/esm-loader.mjs --max-old-space-size=4096\"",
    "server:ec2_prod": "npm run client:build && pm2 start ecosystem.config.js --node-args=\"--experimental-loader newrelic/esm-loader.mjs --max-old-space-size=8192\""
  },

# Install node modules
$ yarn install

# Launch local live servers
$ yarn run dev

# Launch AWS EC2 remote server in development mode
$ yarn run server:ec2_dev

# Make backend unit test using Mocha
$ yarn run test:server_mocha

Visit

User Authentication with Redux Toolkit

Authentication workflow built with the MERN stack & Redux Toolkit.

Features

User Login/SignIn & SignUp
Protected routes with React Router v6
JWT storage with LocalStorage
Automatically fetches user details on page load (Header.js)
React Redux

Usage

Environment Variables

*.env files are as the followings:

> ./environments/dev.env
> ./environments/prod.env

NODE_ENV=YOUR_NODE_ENV # development | production
## Ports
PORT=YOUR_PORT
PORT_REACT=YOUR_REACT_PORT
## MongoDB
MONGO_URI_MAIN=YOUR_MONGO_URI_MAIN
MONGO_URI_INVENTORY=YOUR_MONGO_URI_INVENTORY
MONGO_URI_SUPPLIER=YOUR_MONGO_URI_SUPPLIER
MONGO_URI_MERCHANDISE=YOUR_MONGO_URI_MERCHANDISE
## Secrets / Keys
JWT_SECRET=YOUR_JWT_SECRET
BEARER_TOKEN_PREFIX=YOUR_BEARER_TOKEN_PREFIX
## AWS Server
SERVER_IP=YOUR_SERVER_IP
SERVER_DOMAIN=YOUR_SERVER_DOMAIN
AWS_REGION=YOUR_AWS_REGION
S3_BUCKET_NAME=YOUR_S3_BUCKET_NAME
## Multer Upload
MULTER_DEST_DIR=YOUR_MULTER_DEST_DIR
## Email
DRAPEFIT_SVC_MAIL=YOUR_DRAPEFIT_SVC_MAIL
SUPER_ADMIN_EMAIL=YOUR_SUPER_ADMIN_EMAIL
SUPER_ADMIN_INITPWD=SUPER_ADMIN_INITIAL_PASSWORD
## Payment - Stripe
STRIPE_TEST_SK=YOUR_STRIPE_TEST_SECRET_KEY
STRIPE_LIVE_SK=YOUR_STRIPE_LIVE_SECRET_KEY
STRIPE_ENDPT_SECRET=YOUR_STRIPE_ENDPOINT_SECRET

Frontend (React) Config Variables

frontend/src/configs/MyEnvConfig.js

MyEnvConfig.js file is as below:

export default {
  baseurl: {
    dev: 'YOUR_DEV_BASEURL',
    prod: 'YOUR_PROD_BASEURL'
  },
  stripe: {
    pbKey: 'pk_test_YOUR_PUBLISHABLE_KEY'
  },
  bearer: {
    tokenPrefix: 'YOUR_BEARER_TOKEN_PREFIX'
  },
  gcaptcha: {
    siteKey: 'YOUR_GOOGLE_RECAPTCHA_SITEKEY'
  },
  aws: {
    region: 'YOUR_AWS_REGION',
    s3Bucket: 'YOUR_S3_BUCKET'
  }
};

AWS Credentials by Files

This is necessary for AWS JavaScript SDK integration.

~/.aws/credentials

  [default]
  aws_access_key_id=YOUR_AWS_ACCESS_KEY_ID
  aws_secret_access_key=YOUR_AWS_SECRET_ACCESS_KEY

~/.aws/config

  [default]
  aws_access_key_id=YOUR_AWS_ACCESS_KEY_ID
  aws_secret_access_key=YOUR_AWS_SECRET_ACCESS_KEY

For details, please refer here.

For Win 10, the path would be the following:

C:\Users\admin\.aws

For Ubuntu 20.04 on AWS EC2, the path would be the following:

/home/ubuntu/.aws

Install Dependencies

Backend & Frontend

$ yarn install

$ cd backend
$ yarn install

$ cd frontend
$ yarn install

📌 Fix Low Space Issue on Free-Tier EC2 Instance

Low space issue might occur MongoDB server down💦

# Remove temp files (ONLY on Emergency!!!)
$ sudo rm -rf /tmp/*

# Clear current user's general cache (ONLY on Emergency!!!)
## Resolving the ‘No Space Left on Device’ Error on Linux
$ sudo rm -rf ~/.cache/*

# Remove APT cache
## check the disk space consumed
$ sudo du -csh /var/cache/apt
## clean this cache
$ sudo apt-get clean
## if clean up only the outdated packages
$ sudo apt-get autoclean

# Clean journal logs
## check the log size
$ sudo journalctl --disk-usage
## clear these logs which are older than certain days (e.g. 2 days)
$ sudo journalctl --vacuum-time=2d

# Remove old kernels (optional)
$ sudo apt-get autoremove --purge

📘 Listing file sizes in folder

$ du -hsc * | sort -hr

🎯 MongoDB LogRotate on Ubuntu 20.04

We sometimes experience that the MongoDB server would get down on the EC2 test instance unexpectedly.

Trying to find out what might let the DB server down, I've noticed that the MongoDB log file's size is extremely large, even bigger than 100MB.

Since stdin & stdout processes such as logging are really memory-costing, it would be certainly an overload for the EC2 test instance of small tier.

To solve this issue, I've introduced the LogRotate function of Ubuntu to the MongoDB server.

$ sudo nano /etc/logrotate.d/mongod

Copy and paste the following content:

/var/log/mongodb/*.log {
    daily
    rotate 30
    compress
    dateext
    missingok
    notifempty
    sharedscripts
    postrotate
        /bin/kill -SIGUSR1 `cat /var/lib/mongodb/mongod.lock 2> /dev/null` 2> /dev/null || true
        systemctl restart mongod
    endscript
}

To test the configuration running:

$ logrotate -f -v /etc/logrotate.d/mongod

📌 drapefit-cakephp

Full Source code for Drape Fit (https://www.drapefit.com) which is hosted on cPanel.

I hope this archived project source would be helpful to whom want to learn `CakePHP` at production level...

Database - MySQL

|
|- db_dump_mysql
|--|
|--|-- drapefit_test.sql
|

Style Guide - WordPress

|
|- styleguide
|--|
|

Inventory Page

|
|- inventory
|--|
|

Supplier Page

|
|- supplier
|--|
|

😱🎃

Thoughts on How to Prevent NoSQL Injection for Node.js Express Server

Yang Li — Mon, 05 Jun 2023 05:21:02 +0000

NoSQL injection is a type of vulnerability where an attacker is able to inject arbitrary text into NoSQL queries.

NoSQL injections are very similar to the traditional SQL injection attack, except that the attack is against a NoSQL database. NoSQL is a general term for any database that does not use SQL, a common database management system (DBMS) that utilizes NoSQL is MongoDB.

In this post, I’d like to describe the followings to show how to prevent NoSQL injection:

Build a simple NodeJS app
Understand what a NoSQL Injection attack is
Use a npm package to prevent attacks

For prerequisites, let us assume that we have a ready-to-use MongoDB cluster or a local MongoDB installation and have the connection URI, e.g. http://localhost:27017.

Project Setup

Let us initialize our node.js app and install a couple of packages. Run the following commands in an empty folder.



$ npm init -y
$ npm i express mongoose 
$ npm i nodemon dotenv -D

Or, use Yarn instead.



$ npm init -y
$ yarn add express mongoose 
$ yarn add nodemon dotenv –-dev

Create app.js and models/user.model.js.

app.js



require('dotenv').config();

const express = require('express');
const mongoose = require('mongoose');

const routes = require('./routes/index');

const app = express();

app.use(express.json());

app.use(routes);

mongoose
  .connect(process.env.MONGODB_URI)
  .then(() => {
    console.log('Mongoose connected 🍃');
    app.listen(3000, () => {
      console.log('Server is up and running 🚀');
    });
  })
  .catch((error) => {
    console.log(error);
  });

models/user.model.js



const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  username: {
    type: String,
    unique: true
  },
  password: {
    type: String,
    unique: true
  }
});

const User = mongoose.model('User', userSchema);

module.exports = User;

With the setup out of the way, let us start by looking at a simple NoSQL attack.
For demonstration purposes, I'll create a simple routing file.

routes/index.js



const express = require('express');

const User = require('../models/user.model');

const router = express.Router();

router.get('/users', async (req, res, next) => {
  return res.json({
    users: await User.find({}).exec()
  });
});

router.post('/login', async (req, res, next) => {
  const { username, password } = req.body;

  const user = await User.findOne({ username, password }).exec();

  res.json({
    message: `Logged in as ${user.username}`
  });
});

module.exports = router;

It's time to make a GET request to /users to see what we have. As mentioned previously, we will be using Postman.



// GET localhost:3000/users

{
    "users": [
        {
            "_id": "6125401c491c0b0bfd123165",
            "username": "test1",
            "password": "123456",
            "__v": 0
        },
        {
            "_id": "6125401c491c0b0bfd123166",
            "username": "test2",
            "password": "abcdef",
            "__v": 0
        },
        {
            "_id": "6125401c491c0b0bfd123167",
            "username": "test3",
            "password": "sdjndsn",
            "__v": 0
        }
    ]
}

This is the response that the server returns. As seen from the code block above, we have three users (Passwords are shown for demonstration purposes) for example.

Next, try to log in using one of the credentials. Make a POST request to /login with the request body below.



{
  "username": "test1",
  "password": "123456"
}

We would get the following response. Everything seems pretty normal up to this point, so let us dive deeper!



// POST localhost:3000/login

{
    "message": "Logged in as test1"
}

Perform a demo NoSQL injection!!!

To perform a NoSQL injection attack, simply change the password value in the body from "123456" to { "$ne": "null" }. So, the new request body looks like the following:



{
  "username": "test1",
  "password": { "$ne": null }
}

Hold on, please!
What does the $ne operator do? Let me explain.

$ne operator tells mongo to check for not equal to. That is, instead of checking the password for the correct value, MongoDB will simply check whether the password field is null or not. Since the password field cannot be null in any case, we can trick MongoDB into giving us the user information without knowing the password.

After making a POST request to /login with the new modified request body, we would get the following response from the server.



// POST localhost:3000/login

{
    "message": "Logged in as test1"
}

Oh my god!😱

There is more than one way to do the same thing. For instance, we could have used { "$gt": "" } instead of the $ne operator.

Fortunately, preventing this attack is as easy as performing it. Next, let us take a look at how we can prevent NoSQL injection attacks.

Introduce NPM module

We would install the express-mongo-sanitize package from NPM. Run the following command:



$ npm i express-mongo-sanitize

Or,



$ yarn add express-mongo-sanitize

We can learn the details about this module here:
https://www.npmjs.com/package/express-mongo-sanitize

Requiring the package returns a middleware function, which can then be used as in the example below.



// Prevent NoSQL injection
const mongoSanitize = require('express-mongo-sanitize');

...

// Prevent NoSQL injection
app.use(
  mongoSanitize({
    onSanitize: ({ req, key }) => {
      // Throw an error
      // Catch with express error handler
    }
  })
);

I hope this post would be a bit helpful to prevent NoSQL injection attacks when you implement your node.js express server.

For a full source code, please refer to this GitHub repo:
https://github.com/liyang51827/express-nosql-injection-demo

Using HTTP Strict Transport Security (HSTS) headers in Node.js server

Yang Li — Mon, 05 Jun 2023 03:32:35 +0000

For most websites and apps, employing security-related HTTP headers has become standard practice. Websites use headers as part of HTTP requests and replies to convey information about a page or data sent via the HTTP protocol.
Among the many available security headers that modern web browsers use to protect users, one crucial type is the HTTP Strict Transport Security (HSTS) header. The HSTS header that a website provides tells the browser to use the HTTPS protocol on each subsequent visit.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

However, despite their utility, ease of implementation, and support from virtually every browser, only about 25% of mobile and 28% of desktop HTTP responses include HSTS headers.

Let us take an in-depth look at HSTS headers to discover how they affect web security and why we should use them on Node.js.
Then, I’d like to describe how to enable HSTS inside a Node.js server.

Why enable HSTS?

HTTPS connections are secure because they encrypt and decrypt transmitted data packets using SSL/TLS certificates, which well-known certificate authorities (CAs) can verify. As a result, only the user’s computer and the server can read the transmitted data packets, regardless of who intercepts the network traffic.

Typical HTTP connections are unencrypted, meaning that anyone who accesses the data can read it. These unintended recipients might include servers routing and forwarding the user’s data to its destination server or a hacker who accesses the network traffic on a public Wi-Fi router.

HOW DOES HSTS WORK?

When the HTTP response header contains an HSTS, web browsers know to always use an HTTPS connection with the server and automatically redirect users who first connected via HTTP.
From then on, connections to the web application or site remain encrypted and secure, enabling the app to use secure cookies and helping prevent MITM (man-in-the-middle) security attacks.

There are three different parameters available in the HSTS header.

MAX-AGE



MAX-AGE=<EXPIRE-TIME>

This required parameter specifies the amount of time in seconds that the browser should remember to connect to the site via HTTPS. Once this time expires, the browser will load the site normally on the next visit. The expiration time is updated in the user’s browser every time it sees the HSTS header. As a result, the parameter can remain active indefinitely.
Alternatively, certain sites may immediately disable HSTS by setting this value to 0.

INCLUDESUBDOMAINS

The includeSubDomains parameter is an optional flag that tells the browser to enable HSTS for the website and all its subdomains. Because this setting applies broadly, we should ensure that all of our subdomains can support HTTPS before implementing the parameter.

PRELOAD

An initial connection could potentially use a compromised HTTP connection. In response, Google has maintained the unofficial preload parameter.
Most major browsers support this security header, which significantly mitigates the risk. A website can add the preload parameter to the HSTS header and then register the domain to the preload service. Browsers can then check this reference list to determine whether their initial connections can use HTTPS.

How to implement HSTS in Express (Node.js)

There are 2 options to implement HSTS in Express (Node.js) server.

Option 1: Use Helmet Middleware

https://www.npmjs.com/package/helmet

The first way we can set HSTS is via Helmet middleware with the app initialization:



const app = express();
app.use(helmet());
app.use(helmet.hsts({
  maxAge: 300,
  includeSubDomains: true,
  preload: true
}));

app.use((req, res) => {
  res.send("Hello secure web!");
});

Option 2: Manually Set the Header

Alternatively, we can manually set the HSTS header through a middleware that applies it to every reply:



const app = express();

app.use((req, res) => {
  if (req.secure) {
    res.setHeader("Strict-Transport-Security", "max-age=300; includeSubDomains; preload");
  }
  res.send("Hello secure web!");
});

We can finish the code by creating the HTTP and HTTPS servers with the following code:



const httpServer = http.createServer(app);
httpServer.listen(80, () => {
  console.log("HTTP server started.");
});

const httpsServer = https.createServer(credentials, app);
httpsServer.listen(443, () => {
  console.log("HTTPS server started");
});

Finally, run the server code and open a web browser.



$ node index.js
HTTP server started
HTTPS server started

For a full source code, please refer to this GitHub repo:
https://github.com/liyang51827/express-hsts-demo

This is my first post on DEV Community 👋.
Thanks for your kind attention! 🙏

DEV Community: Yang Li

We're open now. Drape Fit is no longer available...

😱 How? Why?

📌 drapefit-new-trial-mern

New version TRIAL of Drape Fit Web App using `MERN`

ATTENTION! - Do not TRUST this deprecated styling service anymore!!!

I hope this archived project source would be helpful to whom want to learn `MERN` at production level...

System Architecture Diagram

Pre-requisites

User Authentication with Redux Toolkit

Features

Usage

Environment Variables

Frontend (React) Config Variables

AWS Credentials by Files

Install Dependencies

📌 Fix Low Space Issue on Free-Tier EC2 Instance

📌 drapefit-cakephp

I hope this archived project source would be helpful to whom want to learn `CakePHP` at production level...

Database - MySQL

Style Guide - WordPress

Inventory Page

Supplier Page

Thoughts on How to Prevent NoSQL Injection for Node.js Express Server

Project Setup

app.js

models/user.model.js

routes/index.js

Perform a demo NoSQL injection!!!

Introduce NPM module

Using HTTP Strict Transport Security (HSTS) headers in Node.js server

Why enable HSTS?

HOW DOES HSTS WORK?

How to implement HSTS in Express (Node.js)

DEV Community: Yang Li

We're open now. Drape Fit is no longer available...

😱 How? Why?

📌 drapefit-new-trial-mern

New version TRIAL of Drape Fit Web App using MERN

ATTENTION! - Do not TRUST this deprecated styling service anymore!!!

I hope this archived project source would be helpful to whom want to learn MERN at production level...

System Architecture Diagram

Pre-requisites

User Authentication with Redux Toolkit

Features

Usage

Environment Variables

Frontend (React) Config Variables

AWS Credentials by Files

Install Dependencies

📌 Fix Low Space Issue on Free-Tier EC2 Instance

📌 drapefit-cakephp

I hope this archived project source would be helpful to whom want to learn CakePHP at production level...

Database - MySQL

Style Guide - WordPress

Inventory Page

Supplier Page

Thoughts on How to Prevent NoSQL Injection for Node.js Express Server

Project Setup

app.js

models/user.model.js

routes/index.js

Perform a demo NoSQL injection!!!

Introduce NPM module

Using HTTP Strict Transport Security (HSTS) headers in Node.js server

Why enable HSTS?

HOW DOES HSTS WORK?

How to implement HSTS in Express (Node.js)

New version TRIAL of Drape Fit Web App using `MERN`

I hope this archived project source would be helpful to whom want to learn `MERN` at production level...

I hope this archived project source would be helpful to whom want to learn `CakePHP` at production level...