Scott Robinson

David Landup

Dimitrije Stamenic

In this guide - learn the basics of testing in JavaScript with Mocha and Chai - focusing on Unit Testing and creating test suites, with practical code examples.

Testing Node.js Code with Mocha and Chai

N Kaushik

In this tutorial, we'll be converting Strings to datetime in Python, dealing with Timezones. We'll also use dateutil, Maya and Arrow to convert Strings to datetime with automatic format recognition.

Converting Strings to datetime in Python

Uchechukwu Azubuko

In this in-depth guide, we will create a React app and cover a complete guide to how we can perform unit tests on the React application using _Jest_ and _React Testing Library_ so that you can hone your testing skills and learn how to create a tame React application.

Definitive Guide to Unit Testing in React Applications with Jest and React-Testing

<h3 id="introduction">Introduction</h3>
The security of users and their personal data while using a web application is paramount. While this guiding principle has been acknowledged even from the early stages of web development - bad actors find loopholes in applications, and may exploit your users.
<blockquote>
Many &quot;standard&quot; attacks are well-known and documented, and protection from them isn't hard. To unburden the developer from implementing security practices themselves, frameworks like Spring Boot have abstracted away various security measures and allow you to simply apply security filters in your applications to prevent well-known attacks.
</blockquote>
In this short guide, we'll take a look at what Cross-Site Scripting (XSS) is, how someone could perform this attack on your own application, and how you can prevent it easily with Spring Boot.
<h3 id="whatiscrosssitescriptingxss">What is Cross-Site Scripting (XSS)?</h3>
Cross-Site Scripting is a well-known, widely spread exploit, in which a bad actor injects a script into a web application.
Typically, a same-origin policy is applied to web applications, which restricts scripts in a web page to access data from sources if their origins don't match. Under the same-origin policy - if a page from a trusted website may access data interfacing with the user (such as cookies, for example), other pages from the same origin may do so as well. This form of access-control seemed sufficient to protect the integrity of data on web applications at the time.
Cross-Site Scripting circumvents the same-origin policy, by injecting a malicious script into a trusted website's page. Since the script is run from a trusted website, it's executed as a trusted script. There was no clear-cut way to differentiate between malicious scripts and non-malicious scripts - so arbitrary code execution was possible with Cross-Site Scripting. This ranges anywhere from inserting annoying alerts, to social engineering attacks, silently collecting user information, or redirecting users to phishing pages that appear to be parts of trusted websites.
Many websites are susceptible to Cross-Site Scripting attacks, and it remains a common attack today, even though this type of exploit has been known since the 90s.
<h3 id="preventingxssinaspringbootapplicationwithcontentsecuritypolicycsp">Preventing XSS in a Spring Boot Application with Content-Security Policy (CSP)</h3>
Spring Boot takes security seriously, and Spring's Security module implements flexible and powerful security practices that allows developers to minimize their worry when it comes to security, which oftentimes requires a low-level understanding of the principles of the way messages are being exchanged in a web application.
By defauly, Spring Boot implements several security headers:
<pre><code class="hljs">Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
</code></pre>
X-XSS-Protection is included by default! This security header attempts to detect XSS attempts, and blocks them. This isn't a fail-proof process though, and browsers have different implementations of detectors. Some browsers, like Chrome, have even removed their XSS Auditor. Additionally, the automated detection works for Reflected XSS Attacks, while other types of attacks also exist.
A more modern alternative to X-XSS-Protection is the Content-Security Policy (CSP), which primarily deal with policies on which resources can be loaded, from which origins, and at which endpoints. As of 2022, CSP is the best prevention measure against XSS, Clickjacking and other types of attacks. Not all browsers implement CSP, which is why it's not included in the security headers by default.

 <div class="alert alert-note">
 <div class="flex">
 
 <div class="flex-shrink-0 mr-3">
 <img src="/assets/images/icon-information-circle-solid.svg" class="icon" aria-hidden="true" />
 </div>
 
 Note: Even with CSP in place, it's always the best course of action to validate any user input and make sure that it's safe to process using your system, to prevent code injection.

 </div>
 </div>
 In Spring Boot - to configure custom web security measures, you'll typically extend the <code>WebSecurityConfigurerAdapter</code> class, and override the <code>configure()</code> method:
<pre><code class="hljs">@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
	http
	.headers()
		.contentSecurityPolicy(&quot;csp-directives&quot;);
 }
}
</code></pre>
Where the content security policy directives (supplied as a <code>;</code>-separated string) depend on your use-case and which sources you wish to trust:
<pre><code class="hljs">Content-Security Policy: directive1; directive2; directive3; ... directiveN;
</code></pre>
For example, a web application can list trusted websites from which scripts can be loaded with:
<pre><code class="hljs">script-src https://trusted.com;
</code></pre>
Or you can skip trusting any third-party website:
<pre><code class="hljs">script-src self;
</code></pre>
Similarly, an application can trust plugins:
<pre><code class="hljs">object-src https://trusted.com
</code></pre>
There's a wide variety of directives you can supply, including:
<ul>
<li><code>default-src</code> - Default fallback</li>
<li><code>child-src</code> - Valid web worker sources</li>
<li><code>frame-src</code> - Valid sources for <code>&lt;frame&gt;</code>s and <code>&lt;iframe&gt;</code>s</li>
<li><code>img-src</code> - Valid sources for images</li>
<li><code>media-src</code> - Valid sources for <code>&lt;audio&gt;</code>, <code>&lt;video&gt;</code> and <code>&lt;track&gt;</code> tags</li>
<li><code>script-src</code> - Valid script sources (helps prevent XSS)</li>
<li><code>style-src</code> - Valid sources for <code>&lt;style&gt;</code> elements</li>
<li><code>base-uri</code> - Restricts resources accessible from the <code>&lt;base&gt;</code> element</li>
<li><code>frame-ancestors</code> - Valid parents of <code>&lt;frame&gt;</code> <code>&lt;iframe&gt;</code>, <code>&lt;embed&gt;</code>, <code>&lt;applet&gt;</code>, etc. elements</li>
<li>etc.</li>
</ul>

 <div class="alert alert-note">
 <div class="flex">
 
 <div class="flex-shrink-0 mr-3">
 <img src="/assets/images/icon-information-circle-solid.svg" class="icon" aria-hidden="true" />
 </div>
 
 Note: For the full list of accepted CSP directives, take a look at <a target="_blank" rel="nofollow noopener noreferrer" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy">MDN's Documentation</a>.

 </div>
 </div>
 For example, here's a safe set of policy directives:
<pre><code class="hljs">script-src &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; http: https:;
object-src &#x27;none&#x27;;
base-uri &#x27;none&#x27;;
require-trusted-types-for &#x27;script&#x27;;
report-uri https://csp.example.com;
</code></pre>
Let's add these to our Spring Boot application:
<pre><code class="hljs">@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
	http
	.headers()
		.contentSecurityPolicy(&quot;script-src &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; http: https:; object-src &#x27;none&#x27;; base-uri &#x27;none&#x27;; require-trusted-types-for &#x27;script&#x27;; report-uri https://csp.example.com;&quot;);
 }
}
</code></pre>
You can use the <a rel="nofollow noopener noreferrer" target="_blank" href="https://csp-evaluator.withgoogle.com/">CSP-Evaluator</a> to evaluate whether your CSP directives are valid and safe, and it'll point out which directives are easily exploitable. Here's a CSP-directive that allows for Google APIs:
<pre><code class="hljs">default-src &#x27;self&#x27;;
object-src &#x27;none&#x27;;
frame-src &#x27;self&#x27; data:; 
script-src &#x27;self&#x27; &#x27;strict-dynamic&#x27; &#x27;nonce-rAnd0m123&#x27; &#x27;unsafe-inline&#x27; https://storage.googleapis.com; 
style-src &#x27;self&#x27; &#x27;unsafe-inline&#x27;; 
img-src &#x27;self&#x27; data:; 
font-src &#x27;self&#x27; data:;
base-uri &#x27;self&#x27;
</code></pre>
<h3 id="conclusion">Conclusion</h3>
In this short guide, we've taken a look at what Cross-Site Scripting (XSS) is, and how it works at a hollistic level. Then, we've explored some XSS prevention measures that can easily be implemented with Spring Boot to make your applications safe, and set a Content-Security Policy (CSP).
Finally, we've explored CSP directives and took a look at a couple of different safe policies.

In this short guide, learn how to make your Java-based Spring Boot application safe against cross-site scripting (XSS) attacks, using CSP (Content-Safety Policy) and learn about CSP directives.

Prevent Cross-Site Scripting (XSS) in Spring Boot with Content-Security Policies (CSPs)

Cássia Sampaio

In this practical, hands-on, in-depth guide - learn everything you need to know about decision trees, ensembling them into random forests and going through an end-to-end mini project using Python and Scikit-Learn.

Definitive Guide to the Random Forest Algorithm with Python and Scikit-Learn

Guest Contributor

In this guide - learn how to check whether a string contains a digit, number, numeric representation or decimal using various methods, map(), any(), RegEx and lambda functions in Python, with performance benchmarks!

Check If String Contains a Number in Python

In this tutorial, you'll learn how to parse, read, and write JSON to files in Python through examples, using load(), loads(), dump() and dumps() methods. We'll also cover pretty-printing and sorting, enabling or disabling NaN checks, circular references, etc.

Reading and Writing JSON to a File in Python

Arpendu Kumar Garai

In this in-depth guide, learn all you need to know about setting up and using AWS Simple Email Service (SES) in Java with Spring Boot and Spring Cloud.

Guide to Simple Email Service (AWS SES) with Spring Boot and Spring Cloud

In this guide - learn how to properly handle exceptions and errors in Express/Node in JavaScript, with practical code samples and best practices.