New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

App Hardening #473

Open

fcaps opened this issue Nov 19, 2023 · 2 comments

Collaborator

fcaps commented Nov 19, 2023

see: https://expressjs.com/en/advanced/best-practice-security.html

Member

Brutus5000 commented Nov 19, 2023

TLS is solved by our reverse proxy
Prevent brute-force attacks against authorization is solved in the user service
Deprecated versions / unsafe dependencies is what dependabot should help with.

Not sure what actions remain.

Collaborator Author

fcaps commented Nov 19, 2023

some steps like:

session cookie name
helmet http headers (maybe we need not all, but some of them)
app.disable('x-powered-by') lel, opensource... you can't hide

and search/remove unused libs that are loaded, but not used (browser)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment