- [Instructor] Cyber attacks
are a very common occurrence these days.
It is important to make sure we keep our applications
as secure as possible to protect the data that we are using.
We are just going to briefly touch on some of the security
best practices to keep in mind with Express.
For further information regarding security,
please check out some of the other LinkedIn Learning courses
that are available that go more in depth with this topic.
This list was pulled together based on the security concerns
that Express has highlighted in their documentation.
Please visit their site for more in-depth information
regarding security best practices.
First and foremost,
it is important to make sure that you keep
up to date with the most recent version
of Express and other dependency modules that you're using.
Older versions will have vulnerabilities
that can make you susceptible to security issues
in addition to performance issues as well.
You should use TLS encryption with your application.
This will help keep any communication over the web
as secure as possible.
There are even free resources available
like Let's Encrypt that will help you
get a free TLS certificate.
Helmet is a module that can protect your app
by setting HTTP headers appropriately and securely.
It is effectively a collection of middleware functions
that set security related HTTP response headers.
Cookies are the way web browsers store and track data
about a user session
with a particular website or application.
Express has a few middleware modules
to make cookie storage as seamless as possible
for your application.
A brute force attack is a cyber attack
targeted to passwords,
log-in credentials and encryption keys.
Hackers try various combinations
until they find one that works.
You can protect your application from such attacks
by blocking authorization attempts
and there is even a package you can use
called rate-limiter-flexible
to incorporate this into your projects.
And lastly, you want to make sure
that your dependencies are secure.
This can be done very easily using npm-audit
in the command line.