Requirement (Silver level): Hardening mechanisms
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 548
- Forks
- 133
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 2
Description
We agreed on #1175 to open an issue to follow up a discussion about the hardening mechanisms for Node.js (cc: @mhdawson @tniessen @RafaelGSS)
Hardening mechanisms SHOULD be used in the software produced by the project so that software defects are less likely to result in security vulnerabilities.
Hardening mechanisms may include HTTP headers like Content Security Policy (CSP), compiler flags to mitigate attacks (such as -fstack-protector), or compiler flags to eliminate undefined behavior. For our purposes least privilege is not considered a hardening mechanism (least privilege is important, but separate).
Context
- Discussion during the last meeting (Minute 18:58)
- Previous discussions and useful links
Potential actions
- Create a document with all the flags and default http headers included in Node.js by default.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked silver_criteria.md section and the previous discussions, then review the meeting context about Node.js hardening mechanisms. Done means creating a document that covers the compiler flags and default HTTP headers included by Node.js, with the scope aligned to the Silver criterion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100