Welcome to the third lesson of our Server-Side Request Forgery (SSRF) Prevention in Express course! We've covered what SSRF is and how to prevent it in Express applications. Now, let's focus on an equally important aspect: monitoring and responding to SSRF incidents. Even with robust prevention measures, it's essential to detect and respond to potential attacks quickly. Let's dive in! 🔍

Monitoring is a critical component of a comprehensive security strategy. It allows you to:

1. Detect potential SSRF attacks in real-time
2. Collect data for forensic analysis
3. Improve your security measures based on attack patterns
4. Respond quickly to minimize damage

Let's explore how to set up effective monitoring for SSRF vulnerabilities in Express applications.

The first step in monitoring is to set up comprehensive request logging. This allows you to track and analyze all incoming requests, making it easier to detect suspicious activity:

import express from 'express';
import morgan from 'morgan';
import fs from 'fs';
import path from 'path';

const app = express();

// Create a write stream for access logs
const accessLogStream = fs.createWriteStream(
  path.join(__dirname, 'access.log'),
  { flags: 'a' }
);

// Set up request logging
app.use(morgan('combined', { stream: accessLogStream }));

// Example route
app.get('/', (req, res) => {
  res.send('Hello, world!');
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

In this example, we use the morgan middleware to log all HTTP requests to a file. The 'combined' format includes information such as the IP address, request method, URL, status code, and user agent.

Alerting is crucial for timely response to potential security incidents. Let's implement a system to alert administrators when suspicious activity is detected:

import express from 'express';
import nodemailer from 'nodemailer';

const app = express();
app.use(express.json());

// Configure email transporter
const transporter = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    user: process.env.EMAIL_USER || 'your-email@gmail.com',
    pass: process.env.EMAIL_PASSWORD || 'your-email-password'
  }
});

// Function to send alert emails
function alertAdmin(subject: string, message: string) {
  const mailOptions = {
    from: process.env.EMAIL_USER || 'your-email@gmail.com',
    to: process.env.ADMIN_EMAIL || 'admin@example.com',
    subject,
    text: message
  };

  transporter.sendMail(mailOptions, (error, info) => {
    if (error) {
      console.error(`Error sending email: ${error}`);
    } else {
      console.log(`Email sent: ${info.response}`);
    }
  });
}

// Example route to report security incidents
app.post('/report-incident', (req, res) => {
  const { incident } = req.body;
  
  if (!incident) {
    return res.status(400).json({ error: 'Incident details required' });
  }
  
  // Log the incident
  console.warn(`Security incident reported: ${incident}`);
  
  // Alert administrators
  alertAdmin('SSRF Incident Reported', `Details: ${incident}`);
  
  res.json({ success: true });
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

This code sets up an email alert system using Nodemailer. When a security incident is reported, an email is sent to the administrator with details of the incident.

In this lesson, we explored the importance of monitoring and responding to SSRF incidents. We learned how to set up request logging, implement advanced SSRF detection, create an alerting system, and develop an incident response plan. By combining these techniques with the prevention measures from the previous lesson, you can create a robust defense against SSRF vulnerabilities in your Express applications.

In the next lesson, we'll dive deeper into security logging and monitoring, exploring more advanced techniques to enhance your application's security posture. Stay tuned! 🚀