Misconfiguration

📘What it really is

Common misconfigurations, and the fix:

• Verbose errors: stack traces and SQL shown to users reveal internals. Show a generic message with a reference ID; log the details (Module 72). Set NODE_ENV=production.

• Missing security headers. Add (in Nginx, or with Express's helmet):

• Strict-Transport-Security (HTTPS only, Module 66);
• Content-Security-Policy (Lesson 3);
• X-Content-Type-Options: nosniff;
• Referrer-Policy: strict-origin-when-cross-origin;

• frame-ancestors 'none' in the CSP (or X-Frame-Options: DENY) to stop your pages being framed (clickjacking).

• Exposed files: .env, .git folders, backups (db.sql), source maps in public folders. Check none are reachable.

• Default or shared credentials on databases, admin panels, routers.
• Open storage and databases: public buckets, databases reachable from the internet (Modules 66, 68).
• Directory listing turned on, debug endpoints and test pages left in production.
• Too-wide CORS (Lesson 4).

• File uploads: check type and size, store outside the web root or in object storage with random names, never run uploaded files, and serve them with Content-Disposition: attachment where possible (Module 45).

• Check regularly: Mozilla's HTTP Observatory and securityheaders.com scan headers (on your own sites); OWASP ZAP's baseline scan finds many misconfigurations (Module 78).