Secure coding

Learn secure coding principles.

Secure coding principles

Secure coding means thinking about security while writing code; not adding it later. Core principles: validate input, escape output, give least privilege, do not leak error messages.

In React Native user input comes from TextInput. Validate this input before using it: is the email format right, is the length over the limit? Escape it before sending to an API. Do not give internal server paths in error messages; show a general message. Do not log sensitive data to console.log; even with logs off in production it creates risk. These principles shrink the attack surface.

An input validation example

To validate an email input you check its format. A simple method: const emailOk = /[^@]+@[^@]+\.[^@]+/.test(email). This checks whether the email has an @ and a dot.

Stricter validation uses a library; but basic format checks stop most attacks. Length is also bounded: if (email.length > 200) return;. This makes buffer attacks with very long input harder. Validation is done both on the client and the server; the client can be skipped, the server cannot.

Exercise Write an input validation function

Write a validateEmail function. It takes an email parameter. It tests with the /.+@.+\..+/ regex and returns a boolean.

Show example solution

function validateEmail(email) {
  return /.+@.+\..+/.test(email);
}

Test yourself

What should be done with user input?
```
<TextInput value={text} />
```
- It should be validated
- It should go straight to the database
- It should be logged
- It should be ignored
Show answer

It should be validated — Input must be validated before use.
Match each principle to its role

validate input

Format and length
escape output

Stops injection
least privilege

Limited access
hide errors

No internal paths

Email validation

const emailOk = /[^@]+____@[^@]+\.[^@]+/.test(email);

Show answer

const emailOk = /[^@]+@@[^@]+\.[^@]+/.test(email);

Next lesson: Summary - Security

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies