Secure Your Node.js Web Application

Wrapping Up

In this chapter we looked at the session, an integral part of the authentication scheme. We started by setting up a session system and then added layers of security. We looked at how to add a Time-to-Live, secure cookies, mitigate session-fixation attacks, and add protections against hijacking.

We’ve covered our bases for authenticating a user and setting up a secure session, so in the next chapter we’ll look at how to allow or deny user access to resources based on the user’s access level.

Footnotes

[51]

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

[52]

https://github.com/visionmedia/connect-redis

[53]

http://redis.io/

[54]

https://github.com/kcbanner/connect-mongo

[55]

https://github.com/rawberg/connect-sqlite3 ...