Search code examples
node.jsnginxpci-compliance

Hardening node.js/nginx

For PCI requierements I need to hardening a node.js app or nginx server but I only found guides for IIS, Tomcat, operative systems, etc. here you will find the available guides. My questions are:

  • It's possible to hardening node.js?
  • It's possible to hardening a nginx server?
  • Is there any official documentation or trustworthy out there?
Solution

  • For example dev-sec provides nginx hardening roles for puppet, ansible etc...

    To harden a nodejs server the same principles should apply as hardening tomcat. PCI-DSS lists a couple of things you need to do:

    • Disable all unnecessary services.
    • Leave only the necessary ports open. etc.

    First make sure you develop your application according to best practises from a security point of view. For instance, SSL/TLS, CSRF, Error handling, use SNYK or similar, as described here.

    Talk to your QSA about the requirements.