Hardening node.js/nginx

Question

For PCI requierements I need to hardening a node.js app or nginx server but I only found guides for IIS, Tomcat, operative systems, etc. here you will find the available guides . My questions are:

• It's possible to hardening node.js?
• It's possible to hardening a nginx server?
• Is there any official documentation or trustworthy out there?

Answer 1

For example dev-sec provides nginx hardening roles for puppet, ansible etc...

To harden a nodejs server the same principles should apply as hardening tomcat. PCI-DSS lists a couple of things you need to do:

• Disable all unnecessary services.
• Leave only the necessary ports open. etc.

First make sure you develop your application according to best practises from a security point of view. For instance, SSL/TLS, CSRF, Error handling, use SNYK or similar, as described here .

Talk to your QSA about the requirements.