Cybersecurity in Javascript: Top Javascript Vulnerabilities and How to Fix Them
Introduction
Used in over 97% of websites, Javascript is the most popular programming language in the world. Like with any software programming language, development teams should utilize best practices for cybersecurity. Cybercrime is rapidly increasing and poses a major risk for businesses. Taking precautions against Javascript vulnerabilities is vital for ensuring that your website and your users’ data are protected from hackers.This guide explains the most common Javascript security vulnerabilities and how developers can prevent them, to ensure that your web applications are secure. In all, we answer the question, how to make Javascript applications secure. Let’s begin.
Cross-Site Scripting
Cross-site scripting (XSS) is a type of attack where hackers inject malicious scripts into a web application. It is one of the most common web security vulnerabilities and possibly one of the most damaging, as there are many different kinds of attacks that can be done this way. Attackers can potentially steal sensitive data and impersonate users.
Problem
The two main types of XSS attacks are reflected XSS and stored XSS. Reflected XSS occurs when an attacker tricks a user into clicking a specially-crafted URL which includes an embedded script that is transmitted to the target website’s server. The script is then reflected back to the user’s browser and executed. Stored XSS is when the injected script is permanently stored on the target website’s server. This is often done through user input such as a comment field, forum post, or database entries. The user’s browser then executes the script when they visit the webpage.Additionally, there is another kind of XSS attack called DOM-based XSS. Unlike the other attacks described previously, this occurs entirely on the client-side rather than the server-side. In this case, the injected script alters the DOM environment (user’s web page) in the user’s browser, causing it to execute the malicious code. Modern websites have much of their functionality on the client-side, and DOM-based XSS takes advantage of this.
Solution
To prevent XSS attacks, there are various guidelines web developers should follow. The most important is to validate and sanitize all untrusted input. To do this, all input should be encoded for the context it is used in, so that any special characters are escaped.
This can be done through the following simple methods. Many libraries have functions to encode for Javascript contexts. When dealing with HTML contexts, there are attributes that should be avoided for untrusted input. For example, instead of innerHTML, textContent or value should be used instead, because they automatically encode data. Also, unsafe functions such as eval() should not be used at all.
Cross-Site Request Forgery
Cross-site request forgery (CSRF) is when a user is tricked into sending malicious requests to a website they are logged into. This is usually done by having the user click a specially-crafted URL or visit a website controlled by the attacker.
Problem
CSRF allows attackers to perform changes to a user’s account, and potentially grant themselves access or steal private data.
Solution
The most widely-recommended method for preventing these kinds of attacks is CSRF tokens. These are unique values that are randomly generated by the server for each session or request and sent to the user.
When a user makes a request, the token is sent back to the server and verified. So long as an attacker does not have access to the token, they cannot send valid requests to the server.
To prevent CSRF tokens from being intercepted, they should not be sent in cookies. Instead, they should be sent in either hidden fields in forms or as custom header values in AJAX calls. Many Javascript frameworks and libraries have built-in solutions for creating CSRF tokens, such as the pillarjs CSRF middleware.
Insecure Session Management
Problem
Many cyberattacks are not done through complex hacks, but simply taking advantage of websites that are not configured properly for security. If a connection between a user and a website is not secure, attackers on the same network can listen in on the data being sent. This is known as a man-in-the-middle attack (MITM). Here are best practices developers should follow to ensure every session between a user and a website is secure.
Solution
First, websites should always use the HTTPS protocol (HTTP over TLS/SSL), so that every connection is encrypted. Second, when creating session IDs, they should be at least 128 bits long and created using a good pseudorandom number generator (PNRG). This ensures that the ID is sufficiently unique for each session.
Another important practice is to secure cookies. The following attributes are suggested to be set for them:
Secure: Instructs the browser to send cookies over HTTPS only.
HttpOnly: Blocks Javascript access to document.cookie, preventing XSS attacks from stealing the session ID.
SameSite: Blocks cookies from being used in third-party contexts.
Third-Party Package/Library Vulnerabilities
Problem
One of the biggest potential sources of vulnerabilities in a web application is not in its own code, but the packages and libraries it relies on. A vulnerability in a single, widely-used library can affect thousands of websites.
Solution
All packages used in a Javascript application should be regularly audited. The most popular Javascript package managers have an audit function that will create a list of known vulnerabilities in a project. For example, in npm (Node Package Manager), the npm audit command will create a report listing known vulnerabilities in a project and their severity. Updates to fix these vulnerabilities can often be added automatically, while others need to be fixed manually.
Conclusion
Here we discussed the top four vulnerabilities found in Javascript web applications and the steps developers can take to fix them. We looked into:
Cross-site scripting (XSS), where attackers inject their own scripts into web applications, allowing many different kinds of attacks.
Cross-site request forgery (CSRF), where users are tricked into giving control over their accounts.
How to configure Javascript applications for secure session management.
How to audit third-party packages and libraries used in your projects.
Cybersecurity should be a major priority for any enterprise on the Internet. Hardening your website’s security should not be considered an afterthought when the potential financial and reputational damage from a cyberattack is so great.
To learn more about web security, one of the best resources is the Open Web Application Security Project (OWASP). Their OWASP Top 10 list of web application security risks is often used as a standard reference by web developers. OWASP also releases many other useful guides, such as a series of cheat sheets on dealing with web security issues, including those discussed here to prevent Javascript vulnerabilities in your website. If you have a specific Javascript web project in mind, you can contact us for a free consultation.