Enhancing Session Security in TypeScript

Welcome back! In our previous lessons, we explored the fundamentals of session management and how to implement secure sessions in a TypeScript application. Today, we will focus on enhancing session security by protecting against CSRF attacks using CSRF tokens and implementing session anomaly detection. These advanced security measures are crucial for preventing unauthorized access and ensuring the integrity of your web applications. By the end of this lesson, you will be equipped with the knowledge to modify your Express app to incorporate these security enhancements.

Before we dive into the new concepts, let's quickly revisit the secure session setup we've been working with. This setup forms the foundation upon which we'll build our advanced security features.

Here's a reminder of how we configure sessions securely in our Express app:

import express from 'express';
import session from 'express-session';

const app = express();
app.use(express.json());

app.use(session({
  secret: 'your_secret_key',
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 1000 * 60 * 30
  }
}));

Explanation:

• Session Configuration: We use a secret key to sign the session ID cookie, preventing tampering.
• Cookie Options:
  • httpOnly: true prevents client-side JavaScript from accessing the cookie, mitigating XSS risks.
  • secure: process.env.NODE_ENV === 'production' ensures cookies are only sent over HTTPS in production.
  • sameSite: 'strict' helps prevent CSRF attacks by restricting how cookies are sent with cross-site requests.
  • maxAge: 1000 * 60 * 30 sets a 30-minute expiration time, ensuring sessions do not remain active indefinitely.

Cross-Site Request Forgery (CSRF) is a type of attack that tricks a user into performing actions they did not intend to. To protect against CSRF attacks, we use CSRF tokens, which are unique tokens generated for each session and verified with each request.

Let's integrate CSRF protection into our Express app using the csurf middleware:

import csurf from 'csurf';

// CSRF Protection Middleware
const csrfProtection = csurf({ cookie: true });
app.use(csrfProtection);

Explanation:

• CSRF Middleware: The csurf middleware generates a CSRF token for each session and stores it in a cookie. This token must be included in requests that modify data, ensuring that the request is legitimate.

When a user logs in, we send the CSRF token to the client:

router.post('/login', async (req, res) => {
  try {
    const { username, password } = req.body;
    const user = await User.findOne({ where: { username } });

    if (user && await bcrypt.compare(password, user.password)) {
      req.session.regenerate(err => {
        if (err) return res.status(500).json({ error: 'Session error' });

        req.session.userId = user.id;
        return res.json({ 
          message: 'Login successful',
          csrfToken: req.csrfToken()  // Send CSRF token to client
        });
      });
    } else {
      return res.status(401).json({ error: 'Invalid credentials' });
    }
  } catch (error) {
    console.error("Login error:", error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

Explanation:

• CSRF Token: After a successful login, we generate a CSRF token using req.csrfToken() and send it to the client. The client must include this token in subsequent requests that modify data.

Session hijacking is a serious threat where an attacker gains unauthorized access to a user's session. To mitigate this risk, we can implement session anomaly detection by monitoring IP addresses and user agents.

Here's how we can detect session anomalies:

router.use((req, res, next) => {
  if (req.session.userId) {
    const currentIp = req.ip;
    const currentUserAgent = req.headers['user-agent'];

    if (!req.session.ip) req.session.ip = currentIp;
    if (!req.session.userAgent) req.session.userAgent = currentUserAgent;

    if (req.session.ip !== currentIp || req.session.userAgent !== currentUserAgent) {
      req.session.destroy();  // Kill session if suspicious activity is detected
      return res.status(401).json({ error: 'Session anomaly detected, logged out' });
    }
  }
  next();
});

Explanation:

• Anomaly Detection: We store the user's IP address and user agent in the session. If these values change unexpectedly, we destroy the session, preventing unauthorized access.

Let's see how these security measures come together in a secure login and logout process:

// Login with CSRF Token Handling
router.post('/login', async (req, res) => {
  // ... (login logic as shown earlier)
});

// Logout & Session Invalidation
router.post('/logout', (req, res) => {
  req.session.destroy(err => {
    if (err) return res.status(500).json({ error: 'Logout failed' });
    res.clearCookie('connect.sid');  // Remove session cookie
    res.json({ message: 'Logged out' });
});

Explanation:

• Login Process: We handle CSRF tokens and detect session anomalies during login, ensuring that only legitimate requests are processed.
• Logout Process: We destroy the session and clear the session cookie, effectively logging the user out and preventing unauthorized access.

In this lesson, we covered advanced session security measures, focusing on CSRF protection and session anomaly detection. These strategies are essential for protecting your web applications from unauthorized access and ensuring the integrity of user sessions.

As you move on to the practice exercises, you'll have the opportunity to apply what you've learned and reinforce your understanding of secure session management. Congratulations on reaching the end of this course! Your dedication to enhancing your security skills is commendable, and I encourage you to continue exploring and applying these principles in your projects.