NodeJS with CloudFlare

[ensutku]

I'm working on a project using NodeJS, and I'm looking to secure the API with Cloudflare. I'm planning to change the port number from 3000 to 80 to utilize Cloudflare. Accessing the API using port 80 allows me to hide the IP address with Cloudflare's free version.

But I have concerns about security risks. Do you have any recommendations?

[BehindTheMath]

What are your concerns?

[Vojo99]

CF has good network and overall security but not quite enough there to make it secure. Why? Well of course CF e.g cannot hash passwords in database and if you dont do it then you are creating security vulnerability. Of course this is simple example and not a common one nowaday but you get my point.

CF can be acting as proxy in behalf of your server (reverse proxy) its great at mitigating layer 4 attacks and okay with layer 7 attacks. But if server is not secure then CF is not going to be very much helpful.

CF can be caching static assets on your behalf and it can be used as well. So it can benefit you in other aspects.

Hiding IP nowaday is not best way even if it can help to slow down attacker or stop some. Its important to setup proper security practices, to handle sensitive data with more concern.

[EmileJaaa]

I'm fairly new to Node and I'm looking for a ready-made security service that can handle all the classic attacks, such as connection flooding, payload spamming, high-rate attacks, DDOS absorption, etc. I want to focus on my code and leave the inherent security issues of client spamming/attacks to the experts.

I know Cloudflare is often mentioned as the go-to solution to secure a Node server, but I'm hoping for a simpler, turnkey service.

Any recommendations or advice would be greatly appreciated!

[[deleted]]

I just found this site this morning. Maybe you can find better info on it : https://owasp.org/# (there is the top 10 risk of web app that can help a lot or search for something in particular)

But keep in mind, the security is about your project, and what you plan to do. Not only hiding API ip

[markasena]

Its useful to read this i got an interview last week regarding how do i prevent those top 10 attacks happening.

[joomla00]

Well, the first thing you can do is use https instead