BAB 14 - KEAMANAN WEBSITE

Definisi

Arsitektur Aplikasi Web

CIA Triad dalam Web Security

Ancaman Utama Aplikasi Web

HTTP vs HTTPS

TLS/SSL Handshake

TLS Handshake Process
# 1. Client Hello
Client -> Server: Supported cipher suites, TLS version

# 2. Server Hello
Server -> Client: Selected cipher suite, certificate

# 3. Certificate Verification
Client verifies server certificate (CA signature, validity)

# 4. Key Exchange
Client & Server negotiate shared secret key

# 5. Encrypted Communication
Client <-> Server: All data encrypted with shared key

# Contoh cipher suite modern:
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256

SSL/TLS Certificate

Praktik: SSL/TLS Configuration

Nginx - Secure TLS Configuration
# /etc/nginx/nginx.conf

server {
    listen 443 ssl http2;
    server_name example.com;

    # Certificate
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    # Modern TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (HTTP Strict Transport Security)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # Session settings
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
}

Definisi

Authentication Methods

Authorization Models

Praktik: Secure Authentication (Node.js)

Node.js - Secure Authentication
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');

// Password hashing
async function hashPassword(password) {
    const saltRounds = 12;
    return await bcrypt.hash(password, saltRounds);
}

// Password verification
async function verifyPassword(password, hash) {
    return await bcrypt.compare(password, hash);
}

// Login endpoint
app.post('/login', async (req, res) => {
    const { email, password } = req.body;
    
    // Find user
    const user = await User.findOne({ email });
    if (!user) {
        return res.status(401).json({ error: 'Invalid credentials' });
    }
    
    // Verify password
    const valid = await verifyPassword(password, user.passwordHash);
    if (!valid) {
        return res.status(401).json({ error: 'Invalid credentials' });
    }
    
    // Generate JWT
    const token = jwt.sign(
        { userId: user.id, role: user.role },
        process.env.JWT_SECRET,
        { expiresIn: '1h' }
    );
    
    res.json({ token });
});

// Protected route middleware
function authenticateToken(req, res, next) {
    const token = req.headers['authorization'];
    if (!token) return res.sendStatus(401);
    
    jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
        if (err) return res.sendStatus(403);
        req.user = user;
        next();
    });
}

Konsep Session

Cookie Security

Praktik: Secure Session Management

Node.js/Express - Secure Session
const session = require('express-session');

app.use(session({
    // Secret key untuk sign session ID
    secret: process.env.SESSION_SECRET,
    
    // Regenerate session ID setelah login
    resave: false,
    saveUninitialized: false,
    
    // Cookie settings
    cookie: {
        secure: true,           // HTTPS only
        httpOnly: true,         // No JavaScript access
        sameSite: 'strict',     // CSRF protection
        maxAge: 3600000         // 1 hour
    },
    
    // Session store (production)
    store: new RedisStore({ client: redisClient })
}));

// Regenerate session after login
app.post('/login', (req, res) => {
    req.session.regenerate((err) => {
        if (err) return res.status(500).send('Error');
        req.session.userId = user.id;
        res.redirect('/dashboard');
    });
});

// Destroy session on logout
app.post('/logout', (req, res) => {
    req.session.destroy((err) => {
        res.redirect('/');
    });
});

Session Security Best Practices

Konsep Input Validation

Input validation adalah proses memastikan data yang masuk ke aplikasi valid, aman, dan sesuai ekspektasi. Ini adalah pertahanan pertama terhadap banyak serangan web.

Jenis Validasi

Praktik: Input Validation (Node.js)

Node.js - Input Validation
const Joi = require('joi');

// Define validation schema
const userSchema = Joi.object({
    username: Joi.string()
        .alphanum()
        .min(3)
        .max(30)
        .required(),
    
    email: Joi.string()
        .email()
        .required(),
    
    password: Joi.string()
        .pattern(new RegExp('^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)[a-zA-Z\\d]{8,}$'))
        .required(),
    
    age: Joi.number()
        .integer()
        .min(18)
        .max(120)
});

// Validate input
app.post('/register', (req, res) => {
    const { error, value } = userSchema.validate(req.body);
    
    if (error) {
        return res.status(400).json({
            error: 'Validation failed',
            details: error.details
        });
    }
    
    // Input is valid, proceed
    const { username, email, password, age } = value;
    // ... create user
});

// Sanitize HTML input
const sanitizeHtml = require('sanitize-html');

const dirty = '<script>alert("xss")</script><p>Hello</p>';
const clean = sanitizeHtml(dirty, {
    allowedTags: [ 'p', 'b', 'i', 'em', 'strong' ],
    allowedAttributes: {}
});
// Result: '<p>Hello</p>'

Best Practices

Apa itu OWASP Top 10?

OWASP Top 10 (2021)

Mencegah OWASP Top 10

Apa itu SQL Injection?

SQL Injection (SQLi) adalah serangan injection yang memungkinkan attacker menyisipkan query SQL berbahaya melalui input aplikasi. Ini bisa memungkinkan attacker untuk membaca, memodifikasi, atau menghapus data di database.

Contoh SQL Injection

SQL Injection Example
# Vulnerable code (PHP)
$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '" . $username . "'";

# Normal input:
# username = "admin"
# Query: SELECT * FROM users WHERE username = 'admin'

# Malicious input:
# username = "' OR '1'='1"
# Query: SELECT * FROM users WHERE username = '' OR '1'='1'
# Result: Returns ALL users (condition always true)

# More dangerous:
# username = "'; DROP TABLE users; --"
# Query: SELECT * FROM users WHERE username = ''; DROP TABLE users; --'
# Result: Deletes entire users table!

Praktik: Mencegah SQL Injection

Node.js - Preventing SQL Injection
# ❌ VULNERABLE - String concatenation
const query = `SELECT * FROM users WHERE username = '${username}'`;
db.query(query);

# ✅ SECURE - Parameterized query
const query = 'SELECT * FROM users WHERE username = ?';
db.query(query, [username]);

# ✅ SECURE - Using ORM (Sequelize)
const user = await User.findOne({
    where: { username: username }
});

# ✅ SECURE - Using prepared statements (MySQL)
const stmt = db.prepare('SELECT * FROM users WHERE username = ?');
const user = stmt.get(username);

Pencegahan SQL Injection

Apa itu XSS?

Cross-Site Scripting (XSS) adalah vulnerability yang memungkinkan attacker menyisipkan script berbahaya (biasanya JavaScript) ke halaman web yang dilihat oleh user lain. Script ini berjalan di browser korban.

Jenis XSS