Cryptography & Secure Node.js
Cryptographic primitives, password hashing, integrity, TLS, sandboxing, and runtime permissions.
Q46: What is the crypto module used for in Node.js?
The crypto module provides cryptographic functionality, including wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify functions.
- Provides built-in hashing, encryption, and signature generation.
- Leverages native OpenSSL routines for performance.
Which method in crypto generates secure random bytes asynchronously?
Q47: Why is scrypt preferred over MD5 or SHA256 for user password hashing in Node.js?
MD5 and SHA256 are fast cryptographic hashing algorithms designed for high-throughput checksum generation, making them vulnerable to rapid GPU hardware brute-force attacks. crypto.scrypt() is a memory-hard key derivation function deliberately designed to consume significant memory and CPU time, making hardware-accelerated brute-force cracking attempts impractical.
- Fast hash functions (SHA256, MD5) are vulnerable to GPU brute-force attacks.
scryptimposes memory and CPU computational costs to defend against password cracking.
What design trait makes crypto.scrypt() resilient against specialized GPU cracking hardware?
Q48: What is Subresource Integrity (SRI) and how does Node.js crypto generate SRI hashes?
Subresource Integrity (SRI) allows security systems to verify that fetched resources (such as scripts or assets) have not been manipulated. Node.js generates SRI hashes by hashing raw file content using cryptographic algorithms like SHA-384 or SHA-512 and encoding the result in base64 prefixed with the algorithm identifier (e.g., sha384-<base64-hash>).
- SRI guarantees file integrity by comparing cryptographic hashes against expectations.
- Generated in Node.js via
crypto.createHash('sha384').update(data).digest('base64').
What standard encoding format is used for SRI cryptographic hash digest strings?
Q49: How is mutual TLS (mTLS) implemented using the Node.js tls module?
Mutual TLS (mTLS) requires both server and client to authenticate each other using X.509 digital certificates. In Node.js, this is implemented using the tls or https module by setting requestCert: true and rejectUnauthorized: true alongside specifying trusted Certificate Authorities (ca), server certificates (cert), and private keys (key).
- mTLS enforces bidirectional identity verification using SSL certificates.
- Configured via
tls.createServer()withrequestCert: trueandrejectUnauthorized: true.
Which TLS option instructs a Node.js server to reject incoming client connections that lack valid certificates?
Q50: What is the `vm` module, and why is it unsuitable as a security sandbox for untrusted code?
The vm core module allows compiling and running JavaScript code within specific V8 context scopes. While useful for creating isolated execution contexts, it is not a security sandbox. Untrusted code running in a vm context can easily escape by accessing constructors of objects passed into the context (e.g., this.constructor.constructor('return process')()), granting full access to the host Node.js process and system environment. Isolated execution of untrusted code requires dedicated process-level or container-level isolation (e.g., Docker, WebAssembly sandboxes, or isolated-vm).
- The
vmmodule isolates scope contexts, not process permissions or system security boundaries. - Untrusted code can escape
vmcontexts via object prototypes and constructor chains to execute arbitrary host code.
How can untrusted code escape a basic Node.js `vm` context?
Q51: What is the Node.js Security Permission Model (--experimental-permission)?
Node.js includes an experimental Permission Model enabling developers to restrict process capabilities during runtime execution. Using flags like --allow-fs-read, --allow-fs-write, --allow-child-process, or --allow-worker, admins can restrict access to host file system paths, process spawning, or worker thread creation.
- The Permission Model restricts system resource access at runtime level.
- Controls access to file paths, worker creation, and child process execution via explicit flags.
Which flag enables explicit path-level file system read restrictions in Node.js Permission Model?