The pursuit of Hapi-ness: 5 must-have Hapi security plugins

Oct 21, 2016 / 2 min read

Table of Contents

A guide to Hapi authentication plugins
Hapi plugins you can’t live without

Hapi is best known for being a scalable, community-centric framework, but it’s clear that security is also a priority for the team behind it. Hapi makes it easy for developers to validate configurations quickly and without having to perform (many) workarounds, making for a clean, secure codebase. Hapi relies on community-approved plugins to help keep your applications secure, especially when it comes to session storage and authentication.

A guide to Hapi authentication plugins

Earlier this year we wrote a post about Hapi plugins that highlighted a few potential pitfalls with popular Hapi authentication plugins. In case you missed it, here’s a condensed recap:

Hapi-server-session
- What it does: Stores sessions on the server side, but doesn’t integrate with authentication strategies (note: not an official community plugin)
- Best bet: Add session invalidation functionality and integration with authentication strategies
Hapi-auth-cookie
- What it does: Offers cookie-based session management where the user might be authenticated through a secondary measure, but requires a custom solution to store the server-side session storage.
- Best bet: Add setter and getter methods for storing session data in the server cache (which allows the site to revoke sessions) or, for a more scalable approach, consider a more complex but application-specific session management solution like OAuth 2.0
Yar
- What it does: Store sessions on the server side, but isn’t meant as an authentication plugin since it can’t integrate with authentication strategies and automatically creates cookies for unauthorized requests
- Best bet: Use it as a session management tool to manage forms across multiple web pages for logged-out users

Hapi plugins you can’t live without

We realized that we focused a bit too much on how to avoid security issues when using Hapi plugins, and not enough on some of the plugins that get security right. With that in mind, we drew up a list of plugins we like at Black Duck that you should consider using in your Hapi application. Here are the five plugins you won’t want to live without:

Crumb: Anti cross-site-request-forgery (XCSRF) token generation and validation plugin. It works both with regular requests and CORS requests (OWASP recommends using CSRF protection, such as Crumb, along with CORS). Black Duck recommends using Crumb v3.0.0 or newer since a CSRF token leakage issue has been fixed when using Crumb with CORS enabled and the request origin does not match those specified in the CORS configuration.
Joi: Object schema description language and validator for JavaScript objects. Joi allows developers to define a schema for an object and then evaluate the object against that schema thus performing input validation for the object. Everything is defined and evaluated on the server-side so that the attacker cannot easily bypass this protection.
Hapi-rbac: Allows developers to easily implement role-based access controls. Broad enough to grant or deny access to entire groups; granular enough to grant or deny access to individual users.
Blankie: Allows developers to easily set the Content-Security-Policy header directives. The CSP is flexible enough that it may be implemented on a per route basis or across all routes.
Cryptiles: Provides general purpose cryptographic utilities for random number generation, encryption, hashing and fixed-time comparisons of hashes that are based on the Node.js crypto library.

Hapi is an excellent fit for developers who are trying to build stronger, more secure applications. There is also the added benefit of the Hapi ecosystem producing high-quality plugins that are well-maintained. While there is no magic security wand to wave over your code, Hapi helps developers to be proactive and put security as a priority when developing applications.