Hackers Love These Common MERN Stack Mistakes (And How to Avoid Them)

The MERN stack (MongoDB, Express, React, and Node.js) is a popular choice for web application development due to its flexibility and scalability. However, developers often make common mistakes that leave their applications vulnerable to attacks. Hackers exploit these oversights to compromise systems, steal data, or disrupt services. Let’s explore the top mistakes and how you can avoid them.

1. Unsecured MongoDB Instances

The Mistake:

MongoDB’s default configuration allows connections without authentication. Developers often neglect to secure their database, leaving it open to the internet.

Example:

mongod --bind_ip_all

This command binds MongoDB to all IP addresses without requiring authentication, making it accessible to anyone.

The Exploit:

Hackers can easily scan the internet for open MongoDB ports and access sensitive data without resistance.

The Fix:

• Enable authentication by creating an admin user:

db.createUser({
  user: "admin",
  pwd: "securepassword",
  roles: [ { role: "root", db: "admin" } ]
});

• Use a firewall to restrict IP addresses.
• Run MongoDB on a private network or use a VPN.

2. No Rate Limiting on APIs

The Mistake:

Failing to implement rate limiting allows attackers to brute force endpoints or overload your server with excessive requests.

Example:

app.post('/login', async (req, res) => {
  const user = await User.findOne({ email: req.body.email });
  // Authentication logic here
});

This endpoint has no protection against repeated login attempts.

The Exploit:

Hackers use tools like Hydra or Burp Suite to repeatedly try passwords, eventually gaining access.

The Fix:

Use a rate-limiting middleware like express-rate-limit:

const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per window
});

app.use('/login', loginLimiter);

3. Improper Validation of User Input

The Mistake:

Skipping input validation can lead to SQL injection, XSS (Cross-Site Scripting), and other vulnerabilities.

Example:

app.post('/update-profile', async (req, res) => {
  const user = await User.updateOne(
    { email: req.body.email },
    { name: req.body.name }
  );
  res.send(user);
});

Here, user input is directly passed into the query without validation.

The Exploit:

Attackers could inject malicious scripts or manipulate the query to access or delete data.

The Fix:

• Use libraries like joi or express-validator for input validation:

const { body, validationResult } = require('express-validator');

app.post('/update-profile',
  body('email').isEmail(),
  body('name').isLength({ min: 3 }),
  async (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    const user = await User.updateOne(
      { email: req.body.email },
      { name: req.body.name }
    );
    res.send(user);
  });

4. Hardcoding Secrets in Source Code

The Mistake:

Storing API keys, database credentials, or other secrets directly in the code makes them vulnerable to theft, especially in public repositories.

Example:

const dbPassword = "mypassword123";
const apiKey = "abcd1234apikey";

The Exploit:

Attackers accessing your repository or server can steal these credentials and abuse them.

The Fix:

• Use environment variables to store secrets securely:

const dbPassword = process.env.DB_PASSWORD;
const apiKey = process.env.API_KEY;

• Use tools like dotenv to manage environment variables.
• Rotate keys periodically.

5. Insecure Token Management

The Mistake:

Storing tokens in localStorage or failing to expire them properly increases the risk of XSS and session hijacking.

Example:

localStorage.setItem('token', userToken);

The Exploit:

Malicious scripts can access localStorage and steal tokens.

The Fix:

• Use httpOnly cookies for token storage.
• Set secure attributes like SameSite and Secure for cookies:

res.cookie('token', userToken, {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict',
});

6. Ignoring Dependency Vulnerabilities

The Mistake:

Failing to monitor and update third-party libraries leaves your application exposed to known vulnerabilities.

Example:

Using an outdated version of a package with known issues.

{
  "dependencies": {
    "express": "4.16.1"
  }
}

The Exploit:

Hackers can exploit vulnerabilities in older package versions.

The Fix:

• Regularly update dependencies:

npm update

• Use tools like npm audit to identify vulnerabilities:

npm audit fix

• Subscribe to security updates for critical libraries.

By addressing these common mistakes, you can significantly enhance the security of your MERN stack applications. Remember, hackers thrive on negligence. Secure your application today to keep them at bay!