Attack Surfaces in Microservices: What You Need to Know

A malicious user uploads a file or sends an input containing a very long string designed to trigger catastrophic backtracking in regex parsing. can cause the regex engine to hang and consume CPU for seconds or minutes, blocking the Node.js event loop and effectively denying service.

This can cause CPU usage spikes to 100% and the Node.js event loop will be blocked. Your app will hang and no other request can be processed.

Denial of Services (DoS attacks)

A malicious user (or bot) sends a huge JSON body, The JSON might be 500MB or more, with deeply nested structures. This leads to high memory usage, CPU spikes, and eventually heap overflow or crash.

A botnet can send 1000 requests per minute per IP to an endpoint. Since most attackers use rotating IPs (via proxy/VPN), rate-limiting per IP fails. This leads to slow responses, 5xx errors, and potential downtime.

Best Practices to Avoid DoS in Node.js

1. Limit user-controlled regex input.
2. Use safe-regex library to scan regexes for unsafe patterns.
3. Watch for nested dependencies in npm audit (transitive vulnerabilities).
4. Set a request body size limit explicitly:

Injection Attacks (e.g., SQL, NoSQL, Command Injection)

Unsanitized input allows attackers to inject malicious commands or queries.

Mitigations:

• Always sanitize and validate user inputs.
• Use parameterized queries:

Cross-Site Scripting (XSS)

Injecting malicious scripts into HTML rendered in the browser.

Mitigations:

• Escape output using libraries like xss-clean or handle it on the frontend (React does this by default).
• Use CSP (Content Security Policy) headers.
• Sanitize user-generated HTML with libraries like DOMPurify (on frontend).

Insecure Dependencies

Using outdated or vulnerable npm packages.

Mitigations:

• Use npm audit or yarn audit regularly.
• Lock dependencies with package-lock.json or yarn.lock.
• Use tools like:
• Snaky
• GitHub's Dependabot
• Keep all dependencies up to date, especially those handling auth, encryption, HTTP parsing, etc.

Unvalidated Redirects and Forwards

Problem: Malicious redirection to phishing or harmful websites.

Mitigations:

• Avoid redirecting based on user input directly.
• Whitelist redirect URLs or use internal route maps.

Sensitive Data Exposure

Problem: Leaking secrets like passwords, API keys, or tokens, Database Urls. Storing and committing these credentials in repository can put your data and resources at risk. So we should always strive to use the Cloud credential manager or third party tools to manage our secrets. This practice should be followed irrespective of the dev or production environment. We should follow the concept least privilege whether we need to use the credentials in code or to get access to database consoles.

Mitigations:

• Never hardcode secrets.
• Use environment variables (dotenv, process.env).
• Store secrets securely (e.g., Vault, AWS Secrets Manager).
• Hash passwords with bcrypt or argon2 (never MD5 or plain text).
• Use HTTPS for all connections.

Lack of Secure Headers

Problem: Missing HTTP headers opens door to several browser-based attacks. Even if you built strong locks on the vault. But the frontend, the website itself, is the front door. These headers are like extra locks and security cameras on the front door.

For example, cross site scripting can be used to target your third party scripts, database queries and modify the content of original HTML page. The results can be catastrophic.

Mitigations:

The easiest way to do this is to use Helmet.js.

It sets secure defaults for:

• X-Content-Type-Options
• X-Frame-Options
• Strict-Transport-Security
• Content-Security-Policy

Service to Service Communication

the critical need for a zero-trust security model in microservices. The failure came from the assumption that the internal network was safe. A single vulnerability in a seemingly low-risk service (logging) provided the attacker with a foothold. Once inside the "trusted" network, they easily bypassed the rigorous security of a high-value service. This demonstrates that securing the perimeter is insufficient. Every component and every interaction, regardless of its origin, must be validated. The weakest link in a complex system is often the one that nobody is watching.