Now to complete this section,
there are two other aspects that also belong to security.
I showed you some important attacks before,
now I'm not showing attacks to you,
but I'm going to show some mistakes to you,
which you as a developer could make
when you write your backend code.
And these mistakes are
that you might be serving folders statically
that shouldn't be served statically,
and that you actually might be sending
raw error messages to your visitors
because you might not be handling errors
correctly on your backend.
Now, what do I mean with serving
the wrong folders statically?
In our websites,
we sometimes need to serve some content statically.
We often do this with the express static middleware,
and then for example,
I'm serving the content of the public folder statically
so that all of the pages of my website can access
these CSS files without issues.
Now what happens technically there
is that requests are sent to these files.
Now, let me show you what the implications of that are.
If I dive into the XSS folder here
and I start this server there again,
and we then visit local host 3000,
if you open to developer tools
and you open the network tab and reload,
you will see requests for these CSS file there
because the loaded page did include links
to these files in the head section.
And for these links,
requests will be sent for those files
by the browser automatically.
And then once the requests are done,
once the files were returned,
the browser uses them for applying to styling.
That's the wanted behavior here,
but it also means that you can send requests
for these files.
Nothing's stopping you from creating a URL
that looks like this,
the domain slash styles slash base CSS,
because that's the path to these CSS files.
And if you sent this, you can see the CSS code here.
Now that's no problem because that's no information
that shouldn't be viewed and you can view it
with the dev tools anyways,
you can see which styles are affecting which element,
but that is what it means
when you are serving files statically,
they can be requested just like this.
Now, since I'm serving the public folders statically,
that means that anything in the public folder
can be requested just like this.
Hence you of course,
should not put any data or any files in there
that should not be publicly accessible.
You shouldn't store user data in there
in text or adjacent files.
You shouldn't store a password file in there.
You should only have files in the public folder
that may be accessed by the public.
You also, for example,
shouldn't start serving the overall folder
statically like this,
because then all your code files
would be accessible like this
and people could read your backend code.
They normally can't,
but if you start serving all the files
in your project statically like this,
they will be able to do so,
and you definitely don't want that.
And that's what you should keep in mind
when you are serving files statically.
All the statically served files can be requested
without any problems, and hence you want that
for your CSS, for your browser-side JavaScript,
and for some images,
but you do not want that for other files.
So be careful when serving content statically
and don't serve the wrong folders statically.
So what's up with errors.
Well you want to make sure
that whenever something goes wrong
in your backend code, which can happen,
that you are handling this error somehow.
For example,
with that default express error handling function
so that you send back a standardized error message
or page to your users.
Now, therefore you should, for example,
make sure that you do have a custom error handling
functionality in place and that this error object,
which contains all the details,
is not forwarded like that queue the front end.
And you don't want to output all the error details
on your main page because it's nothing your users
should see in status,
simply use a generic error page there as I'm doing it here.
That's also something you should keep in mind.
And that was the last thing I also wanted to cover here
to make sure that you don't add any vulnerabilities
or leaks to your website
where you might be exposing more information
or more access than you want to.