{"id":16298113,"url":"https://github.com/quinnturner/owasp-js","last_synced_at":"2025-07-14T09:14:43.010Z","repository":{"id":209738636,"uuid":"724833705","full_name":"quinnturner/owasp-js","owner":"quinnturner","description":"TypeScript security utilities following OWASP best practices","archived":false,"fork":false,"pushed_at":"2024-08-10T17:04:54.000Z","size":191,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-18T00:31:02.935Z","etag":null,"topics":["logging","owasp","security"],"latest_commit_sha":null,"homepage":"https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html#input-validation-input","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/quinnturner.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-28T22:13:32.000Z","updated_at":"2024-08-10T17:04:57.000Z","dependencies_parsed_at":"2024-05-02T20:00:01.024Z","dependency_job_id":"fa6a2acb-085e-411d-8f45-33abe6631b2c","html_url":"https://github.com/quinnturner/owasp-js","commit_stats":null,"previous_names":["quinnturner/owasp-logging","quinnturner/owasp","quinnturner/owasp-js"],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quinnturner%2Fowasp-js","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quinnturner%2Fowasp-js/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quinnturner%2Fowasp-js/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quinnturner%2Fowasp-js/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/quinnturner","download_url":"https://codeload.github.com/quinnturner/owasp-js/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248062271,"owners_count":21041526,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["logging","owasp","security"],"created_at":"2024-10-10T20:43:35.334Z","updated_at":"2025-04-09T15:46:02.211Z","avatar_url":"https://github.com/quinnturner.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OWASP\n\nThis package is intended to assist developers to follow OWASP best practices.\n\nCurrently, it implements the OWASP Cheat Sheet for [Application Logging Vocabulary](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html#input-validation-input), a standard vocabulary for logging security events.\n\nThe intent is to simplify monitoring and alerting such that, assuming developers trap errors and log them using this vocabulary, monitoring and alerting would be improved by simply keying on these terms.\n\nThis logging standard would seek to define specific keywords which, when applied consistently across software, would allow groups to simply monitor for these events terms across all applications and respond quickly in the event of an attack.\n\n## Installation\n\n```bash\nnpm install owasp\n# yarn add owasp\n# pnpm install owasp\n# bun install owasp\n```\n\n## Usage\n\n### Logging vocabulary\n\nHere is an example of how to use this package with [pino](https://github.com/pinojs/pino)\nand [Express](https://github.com/expressjs/express) to log authentication events.\n\n\u003e Authentication is a complex topic and this example is not intended to be used in production.\n\u003e Use this as a baseline for how to use this package to log authentication events.\n\n**You can use any logger you want!** This package simply provides a set of standard events to log.\n\n```ts\nimport { Router } from \"express\";\n// Alternatively,\n// import * as vocab from 'owasp/vocab';\nimport {\n  authn_login_fail,\n  authn_login_fail_max,\n  authn_login_success,\n} from \"owasp/vocab\";\nimport { logger as rootLogger } from \"../logger.js\";\n\nconst router = Router();\n\nconst MAX_FAILED_LOGIN_ATTEMPTS = 5;\n\nrouter.route(\"/login\").post(async (req, res, next) =\u003e {\n  try {\n    const { userId, password } = req.body;\n\n    // Create a child logger to automatically include context in all logs\n    // Note, `requestId` is a custom property that is added to the request\n    // object by a middleware.\n    const logger = rootLogger.child({ userId, requestId: req.requestId });\n\n    if (!userId || !password || userId.length === 0 || password.length === 0) {\n      logger.warn(\n        {\n          // owasp/vocab provides a set of standard events to log.\n          // Use the `event` property to log the event.\n          // The result of this function is: `authn_login_fail:${userId}`\n          event: authn_login_fail(userId),\n        },\n        `User ${userId} login failed because username or password was not provided`\n      );\n      return res.status(401).send(\"Invalid username or password.\");\n    }\n\n    const user = await getUserById(userId);\n\n    if (!user) {\n      logger.warn(\n        {\n          event: authn_login_fail(userId),\n        },\n        `User ${user} login failed because user does not exist`\n      );\n      return res.status(401).send(\"Invalid username or password.\");\n    }\n    if (!checkPassword(user.password, password)) {\n      user.failedLoginAttempts++;\n\n      if (\n        user.failedLoginAttempts \u003e= MAX_FAILED_LOGIN_ATTEMPTS \u0026\u0026\n        user.lastFailedLoginAttempt \u003e Date.now() - 5 * 60 * 1000\n      ) {\n        logger.warn(\n          {\n            event: authn_login_fail_max(userId, MAX_FAILED_LOGIN_ATTEMPTS),\n          },\n          `User ${userId} reached the login fail limit of ${MAX_FAILED_LOGIN_ATTEMPTS}`\n        );\n        const lockReason = \"maxretries\";\n        logger.warn(\n          {\n            event: authn_login_lock(userId, lockReason),\n          },\n          `User ${userId} login locked because ${lockReason} exceeded`\n        );\n        user.locked = true;\n        await user.save();\n        return res.status(429).send(\n          `You have reached the login fail limit of ${MAX_FAILED_LOGIN_ATTEMPTS} attempts.\\\n                        Please wait 5 minutes and try again.`\n        );\n      }\n      logger.warn(\n        {\n          event: authn_login_fail(userId),\n        },\n        `User ${user} login failed`\n      );\n      await user.save();\n      return res.status(401).send(\"Invalid username or password.\");\n    }\n    if (user.locked) {\n      logger.warn(\n        {\n          event: authn_login_fail(userId),\n        },\n        `User ${userId} login failed because user is locked`\n      );\n      return res.status(401).send(\"Account is locked. Please contact support.\");\n    }\n\n    if (user.failedLoginAttempts \u003e 0) {\n      logger.info(\n        {\n          event: authn_login_successafterfail(userId, user.failedLoginAttempts),\n        },\n        `User ${userId} login successfully`\n      );\n    } else {\n      logger.info(\n        {\n          event: authn_login_success(userId),\n        },\n        `User ${userId} login successfully`\n      );\n    }\n\n    user.failedLoginAttempts = 0;\n    await user.save();\n\n    res.cookie(\"session\", createSession(user));\n\n    const userResponse = toUserResponse(user);\n\n    return res.status(200).send(userResponse);\n  } catch (err) {\n    next(err);\n  }\n});\n\nexport default router;\n```\n\n\u003e [!Tip]\n\u003e The IntelliSense of `owasp/vocab` will help you to know which events are available, what level to log them at, and what properties to include.\n\u003e ![VSCode IntelliSense](./docs/assets/authn_login_fail.png)\n\n\u003e [!IMPORTANT]  \n\u003e Logging events is not enough to secure your application. You should also monitor these events and take action when necessary.\n\u003e [We have provided some example implementations using popular logging and alerting tools](./docs/vocab-monitoring.md).\n\n### DOM Utilities\n\nThis package also provides a set of DOM utilities to help increase security.\n\n```ts\nimport { openPopup } from \"owasp/dom\";\n\nfunction onClick() {\n  // Applies the following attributes to the window:\n  // * - `'noopener'`: Prevents the new window from having access to the originating window via `Window.opener`.\n  // * - `'noreferrer'`: Omits the `Referer` header and sets `noopener` to true.\n  // Subsequently, it resets the `opener` property of the new window to `null`.\n  // This prevents the new window from being able to navigate the originating window.\n  openPopup(\"https://example.com\", \"Window name\", \"width=200,height=200\");\n}\n```\n\n## Contributing\n\nContributions are welcome!\n\n```bash\nbun install\n```\n\nEnsure linting, formatting, and tests pass before submitting a PR.\n\n```bash\nbun run check\nbun test # let's keep the test coverage at 100%!\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquinnturner%2Fowasp-js","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fquinnturner%2Fowasp-js","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquinnturner%2Fowasp-js/lists"}