Agenda

<aside> 📌 Reminders

• Submit lab by October 20, 2024
• Project Proposal is out </aside>

🔐 HTTPS

HTTPS provides two critical features:

1. End-to-end encryption of data between client and server.
2. Authentication handshake to verify the server's identity.

To enable HTTPS in an Express app, you need two assets:

1. Secret key (server.key)
2. Public certificate (server.crt)

These can be generated using openssl:

$ openssl req -x509 -nodes -newkey rsa:4096 -keyout server.key -out server.crt

Configuring HTTPS in Express

import { readFileSync } from "fs";
import { createServer } from "https";

const privateKey = readFileSync('server.key');
const certificate = readFileSync('server.crt');
const config = { key: privateKey, cert: certificate };

createServer(config, app).listen(3000, () => {
    console.log("HTTPS server on https://localhost:3000");
});

Input Validation

To prevent attacks such as Cross-Site Scripting (XSS) and Content Spoofing, validate all user inputs both on the client-side and server-side.

• On the client-side: Validate all inputs from the user (URL, forms, etc.).
• On the server-side: Use middleware like express-validator to sanitize and validate HTTP request data.

Cookie Flags

HttpOnly Flag

Prevents cookies from being accessed by JavaScript, reducing the risk of XSS attacks.