Menene mahimman ayyukan tsaro para da Node.js app?

Question

Accepted Answer

Watsewa Node app yana nufin karewa akan haɗin-kai gabatarwa (OWASP Top 10) a dangane da matakai da dama — manajementi sako, tabbatarwa, abin dogaro, da tsara. Tsaro yana da waje (karewa a zurfin), ba warewa gida kawai ba.

## 1. Bada amsa kuma tsafta duk sako

```js
import { z } from "zod";
// never trust client input — validate shape/type before using it
const schema = z.object({ email: z.string().email(), age: z.number().min(0) });
const data = schema.parse(req.body); // rejects malformed/malicious input
```

## 2. Hani iyowa (SQL, NoSQL, umarnin)

```js
// ❌ string concatenation → SQL injection
db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
// ✅ parameterized queries — input is data, never executable SQL
db.query("SELECT * FROM users WHERE id = $1", [req.params.id]);
```

Komai yi amfani da parameterized queries / ORM, kuma kada jiya gida umarnin daga sako mai malami (duba umarnin iyowa tare da `child_process`).

## 3. Tabbatarwa & sirrinun

```text
✓ Hash passwords with bcrypt/argon2/scrypt (slow + salted) — never plain/SHA
✓ Store secrets in env vars, never in code/git
✓ Use httpOnly, secure, sameSite cookies for sessions (XSS-resistant)
✓ Sign/verify JWTs properly; keep tokens short-lived
```

## 4. Saita kakannan tsaro & iyakake-iyaka

```js
import helmet from "helmet";
import rateLimit from "express-rate-limit";

app.use(helmet()); // sets secure HTTP headers (CSP, HSTS, X-Frame-Options, etc.)
app.use(rateLimit({ windowMs: 60_000, max: 100 })); // throttle abuse/brute-force
```

`helmet` yana ƙara kakannan karewa; iyakake-iyaka yana karewa dashi brute-force da DoS.

## 5. Jiya abin dogaro na tsaro (jeren bayan samar da kaya)

```bash
npm audit          # check installed packages for known vulnerabilities
npm audit fix
# + keep deps updated; review postinstall scripts; pin versions via the lockfile
```

Yawancin lambar Node shine taimakon jiya — rashin amintaccen abin dogaro shine manyan hari. Bada amsa kuma sabunta a yau da kullun.

## 6. Sauran mahimman abubuwa

```text
✓ Use HTTPS (TLS) everywhere; redirect HTTP → HTTPS
✓ Don't leak error details/stack traces to clients in production
✓ Escape output to prevent XSS (frameworks usually do this)
✓ Implement proper authorization (not just authentication) — check permissions per action
✓ CORS configured to an allowlist, not "*" for credentialed APIs
✓ Limit request body size to prevent payload-based DoS
```

## Me yasa yake mahimmanci

Ayyukan baƴi ina da jawo, kuma ayyukan Node yana buɗe ga dukkan manyan haɗin-kai gabatarwa — iyowa, tsawaitaccen tabbatarwa, XSS, rashin amintaccen abin dogaro, tsara mara kyau.

Ba warewa gida kawai ke wadatarwa; tsaro shine **waje**: bada amsa sako, parameterized queries, zance kalmomin sirri daidai, saita sirri na aminci, saita kakannan karewa, iyakake-iyaka, bada amsa abin dogaro, kuma yi amfani da HTTPS.

Jiya ayyukan nan (da haɗin-kai OWASP a bayansa) yana da mahimmanci aljihu don duk wanda yake gina ayyukan Node na gida - waje gida (iyowa, sirri da aka tada, abin dogaro marasa kyau) zai iya lalata duk tsarin.