Data Integrity Fundamentals

Introduction

Welcome to the very first lesson of the " Creating a Secure App following OWASP Top 10 Risks (Part 2) " course! In this lesson, we will explore the fundamentals of data integrity, a crucial aspect of secure data handling. Data integrity ensures that information remains accurate, consistent, and reliable throughout its lifecycle. By the end of this lesson, you'll understand the importance of data integrity and how to implement it in your applications. Let's dive in! 🚀

Understanding Data Integrity

As we discussed earlier, if an attacker already has access to some endpoints or the network, it is still important to limit their capabilities. Previously, we focused on securing specific types of data that attackers can target, such as user credentials and JWT tokens. Now, let's consider a more generalized approach, focusing on the integrity of ANY DATA within the application. Data integrity is the assurance that data is accurate, consistent, and reliable. It plays a vital role in maintaining the trustworthiness of information, especially in applications where data is frequently accessed and modified. There are three main types of data integrity: Physical Integrity : Ensures that data is stored and retrieved without corruption due to hardware failures or environmental factors. Logical Integrity : Maintains the correctness and validity of data within a database, ensuring that it adheres to predefined rules and constraints. Referential Integrity : Ensures that relationships between data in different tables remain consistent, preventing orphaned records or invalid references. Understanding these types helps us appreciate the various ways data integrity can be compromised and the importance of safeguarding it. In this lesson, we primarily focus on logical and referential integrity. To better understand how logical and referential integrity apply in real-world Express applications, consider a case where multiple related entities (e.g., users and their posts) exist in a database. Logical integrity ensures that a user's email follows a proper format and is unique, while referential integrity ensures that every post references a valid user ID. If a user is deleted, cascading deletes or foreign key constraints are often used to maintain referential integrity. These constraints are typically enforced at the database level (e.g., PostgreSQL, MySQL).

The Vulnerable Code

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

TypeScript

import express from 'express';

const app = express();
app.use(express.json());

app.post('/api/snippets', (req, res) => {
  const { content } = req.body;
  // Store content in the database without any integrity checks
  res.json({ message: 'Snippet stored', content });
});

import express from 'express';

const app = express();
app.use(express.json());

app.post('/api/snippets', (req, res) => {
  const { content } = req.body;
  // Store content in the database without any integrity checks
  res.json({ message: 'Snippet stored', content });
});

TypeScript

import crypto from 'crypto';

// Function to hash data
function hashData(data: string): string {
  return crypto.createHash('sha256').update(data).digest('hex');
}

// Example of hashing snippet content
app.post('/api/snippets', (req, res) => {
  const { content } = req.body;
  const hashedContent = hashData(content);
  // Store hashedContent in the database
  res.json({ message: 'Snippet stored with hash', hash: hashedContent });
});

import crypto from 'crypto';

// Function to hash data
function hashData(data: string): string {
  return crypto.createHash('sha256').update(data).digest('hex');
}

// Example of hashing snippet content
app.post('/api/snippets', (req, res) => {
  const { content } = req.body;
  const hashedContent = hashData(content);
  // Store hashedContent in the database
  res.json({ message: 'Snippet stored with hash', hash: hashedContent });
});

TypeScript

app.get('/api/snippets/:id', (req, res) => {
  const { id } = req.params;
  // Retrieve snippet and its hash from the database
  // Example: const snippet = db.getSnippetById(id);
  const snippet = { content: 'example', hash: 'exampleHash' }; // Placeholder

  // Verify the integrity of the retrieved snippet
  const isValid = verifyDataIntegrity(snippet.content, snippet.hash);
  if (isValid) {
    res.json(snippet);
  } else {
    res.status(403).json({ error: 'Data integrity check failed' });
  }
});

app.get('/api/snippets/:id', (req, res) => {
  const { id } = req.params;
  // Retrieve snippet and its hash from the database
  // Example: const snippet = db.getSnippetById(id);
  const snippet = { content: 'example', hash: 'exampleHash' }; // Placeholder

  // Verify the integrity of the retrieved snippet
  const isValid = verifyDataIntegrity(snippet.content, snippet.hash);
  if (isValid) {
    res.json(snippet);
  } else {
    res.status(403).json({ error: 'Data integrity check failed' });
  }
});

TypeScript

// Function to verify HMAC
function verifyHMAC(data: string, hmac: string, secret: string): boolean {
  const calculatedHMAC = crypto.createHmac('sha256', secret).update(data).digest('hex');
  return calculatedHMAC === hmac;
}

// Example of verifying snippet data
app.get('/api/snippets/:id', (req, res) => {
  const { id } = req.params;
  const secret = process.env.HMAC_SECRET;
  // Retrieve snippet and its HMAC from the database
  const snippet = { content: 'example', hmac: 'exampleHMAC' }; // Placeholder
  const isValid = verifyHMAC(snippet.content, snippet.hmac, secret);
  if (isValid) {
    res.json(snippet);
  } else {
    res.status(403).json({ error: 'Invalid HMAC' });
  }
});

// Function to verify HMAC
function verifyHMAC(data: string, hmac: string, secret: string): boolean {
  const calculatedHMAC = crypto.createHmac('sha256', secret).update(data).digest('hex');
  return calculatedHMAC === hmac;
}

// Example of verifying snippet data
app.get('/api/snippets/:id', (req, res) => {
  const { id } = req.params;
  const secret = process.env.HMAC_SECRET;
  // Retrieve snippet and its HMAC from the database
  const snippet = { content: 'example', hmac: 'exampleHMAC' }; // Placeholder
  const isValid = verifyHMAC(snippet.content, snippet.hmac, secret);
  if (isValid) {
    res.json(snippet);
  } else {
    res.status(403).json({ error: 'Invalid HMAC' });
  }
});

TypeScript

// Function to verify digital signature
function verifySignature(data: string, signature: string, publicKey: string): boolean {
  const verify = crypto.createVerify('SHA256');
  verify.update(data);
  verify.end();
  return verify.verify(publicKey, signature, 'base64');
}

// Example of verifying admin action
app.get('/api/admin/test', (req, res) => {
  const { signature } = req.headers;
  const publicKey = 'examplePublicKey'; // Placeholder
  const data = 'adminAction';
  const isValid = verifySignature(data, signature as string, publicKey);
  if (isValid) {
    res.json({ message: 'Admin action verified' });
  } else {
    res.status(403).json({ error: 'Invalid signature' });
  }
});

// Function to verify digital signature
function verifySignature(data: string, signature: string, publicKey: string): boolean {
  const verify = crypto.createVerify('SHA256');
  verify.update(data);
  verify.end();
  return verify.verify(publicKey, signature, 'base64');
}

// Example of verifying admin action
app.get('/api/admin/test', (req, res) => {
  const { signature } = req.headers;
  const publicKey = 'examplePublicKey'; // Placeholder
  const data = 'adminAction';
  const isValid = verifySignature(data, signature as string, publicKey);
  if (isValid) {
    res.json({ message: 'Admin action verified' });
  } else {
    res.status(403).json({ error: 'Invalid signature' });
  }
});

TypeScript

import express from 'express';

const app = express();
app.use(express.json());

app.post('/api/snippets', (req, res) => {
  const { content } = req.body;
  // Store content in the database without any integrity checks
  res.json({ message: 'Snippet stored', content });
});

TypeScript

import crypto from 'crypto';

// Function to hash data
function hashData(data: string): string {
  return crypto.createHash('sha256').update(data).digest('hex');
}

// Example of hashing snippet content
app.post('/api/snippets', (req, res) => {
  const { content } = req.body;
  const hashedContent = hashData(content);
  // Store hashedContent in the database
  res.json({ message: 'Snippet stored with hash', hash: hashedContent });
});

TypeScript

app.get('/api/snippets/:id', (req, res) => {
  const { id } = req.params;
  // Retrieve snippet and its hash from the database
  // Example: const snippet = db.getSnippetById(id);
  const snippet = { content: 'example', hash: 'exampleHash' }; // Placeholder

  // Verify the integrity of the retrieved snippet
  const isValid = verifyDataIntegrity(snippet.content, snippet.hash);
  if (isValid) {
    res.json(snippet);
  } else {
    res.status(403).json({ error: 'Data integrity check failed' });
  }
});

TypeScript

// Function to verify HMAC
function verifyHMAC(data: string, hmac: string, secret: string): boolean {
  const calculatedHMAC = crypto.createHmac('sha256', secret).update(data).digest('hex');
  return calculatedHMAC === hmac;
}

// Example of verifying snippet data
app.get('/api/snippets/:id', (req, res) => {
  const { id } = req.params;
  const secret = process.env.HMAC_SECRET;
  // Retrieve snippet and its HMAC from the database
  const snippet = { content: 'example', hmac: 'exampleHMAC' }; // Placeholder
  const isValid = verifyHMAC(snippet.content, snippet.hmac, secret);
  if (isValid) {
    res.json(snippet);
  } else {
    res.status(403).json({ error: 'Invalid HMAC' });
  }
});

TypeScript

// Function to verify digital signature
function verifySignature(data: string, signature: string, publicKey: string): boolean {
  const verify = crypto.createVerify('SHA256');
  verify.update(data);
  verify.end();
  return verify.verify(publicKey, signature, 'base64');
}

// Example of verifying admin action
app.get('/api/admin/test', (req, res) => {
  const { signature } = req.headers;
  const publicKey = 'examplePublicKey'; // Placeholder
  const data = 'adminAction';
  const isValid = verifySignature(data, signature as string, publicKey);
  if (isValid) {
    res.json({ message: 'Admin action verified' });
  } else {
    res.status(403).json({ error: 'Invalid signature' });
  }
});

Introduction

Understanding Data Integrity

The Vulnerable Code

Join the 1M+ learners on CodeSignal

Implementing Data Hashing

Retrieving and Verifying the Snippet

Implementing HMAC Verification

Implementing Digital Signature Verification

Conclusion and Next Steps