How to Build a Secure Node.js Application with Cryptography Best Practices

Building secure applications is essential, especially when dealing with sensitive data. Cryptography helps ensure that user data, such as passwords and payment details, are protected from malicious actors.

In this post you will explore how to implement cryptography in a Node.js application using best practices.

What is Cryptography?

Cryptography is the method used to secure information by converting it into an unreadable format, which can only be decrypted by authorized users. In Node.js, cryptography plays a vital role in securing data in transit (while being sent over the network) and at rest (when stored in databases).

Setting Up Cryptography in Node.js

Node.js has a built-in module called crypto that provides various cryptographic functionalities like encryption, hashing, and digital signatures. You don’t need to install any additional packages to use it.

1. Hashing Passwords with Salt

Hashing passwords ensures that even if your database is compromised, the passwords are not easily accessible. However, using plain hashing can be risky because attackers can use precomputed hash databases to guess passwords. The solution is to add a "salt" and random value to the password before hashing.

Here’s how to hash a password with salt:

const crypto = require('crypto');

function hashPassword(password) {
  const salt = crypto.randomBytes(16).toString('hex'); // Generate a random salt
  const hash = crypto.createHmac('sha256', salt)  // SHA-256 HMAC for secure hashing
    .update(password)
    .digest('hex');
  return { hash, salt };
}

const password = 'user_password';
const { hash, salt } = hashPassword(password);
console.log(`Hashed password: ${hash}, Salt: ${salt}`);

Best Practice:
Always store both the hash and salt in the database, and when users log in, hash their input with the same salt.

2. Encrypting Sensitive Data

Encryption ensures that sensitive information, such as credit card numbers, is securely stored or transmitted. Here’s how you can encrypt and decrypt data in Node.js:

Encrypting Data:

const crypto = require('crypto');

function encryptData(data, secretKey) {
  const cipher = crypto.createCipher('aes-256-cbc', secretKey);
  let encrypted = cipher.update(data, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return encrypted;
}

const secretKey = 'my_secret_key';
const data = 'Sensitive data to encrypt';
const encryptedData = encryptData(data, secretKey);
console.log('Encrypted Data:', encryptedData);

Decrypting Data:

function decryptData(encryptedData, secretKey) {
  const decipher = crypto.createDecipher('aes-256-cbc', secretKey);
  let decrypted = decipher.update(encryptedData, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

const decryptedData = decryptData(encryptedData, secretKey);
console.log('Decrypted Data:', decryptedData);

Best Practice:
Never hardcode encryption keys in your code. Use environment variables or a key management service to store your keys securely.

3. Using Secure Communication (SSL/TLS)

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are protocols that provide encryption for data in transit. Always use HTTPS (SSL/TLS) to secure communication between your server and clients.

Here’s how you can enable HTTPS with Node.js:

const fs = require('fs');
const https = require('https');
const app = require('express')();

const options = {
  cert: fs.readFileSync('path/to/certificate.crt'),
  key: fs.readFileSync('path/to/private.key'),
};

https.createServer(options, app).listen(443, () => {
  console.log('Server running on HTTPS');
});

Best Practice:
Always use HTTPS in your production environment to protect sensitive data.

Best Practices for Node.js Cryptography

Use Secure Algorithms: Use strong algorithms like AES-256 for encryption and SHA-256 for hashing.

Key Management: Avoid hardcoding keys in your code. Use secure methods like environment variables to manage them.

Salting Passwords: Add a salt to passwords before hashing to protect against precomputed hash attacks.

Use HTTPS: Always use HTTPS to secure data in transit between your server and clients.

Conclusion

Implementing cryptography in your Node.js application is essential for protecting sensitive data. By following best practices such as hashing with salt, encrypting sensitive data, using SSL/TLS, and managing keys securely, you can build a secure Node.js application that keeps your users' information safe.

If you're unsure how to integrate these features into your application, it's always a good idea to hire Node.js developers who specialize in secure coding practices. With their expertise, you can ensure that your application is as secure as possible.

Lucy @lucy1