SecureDev Coffee is a multi-page educational web application that teaches developers about common web security vulnerabilities, specifically SQL Injection (SQLi) and Stored Cross-Site Scripting (XSS).
The application provides interactive, side-by-side demonstrations of vulnerable and secure coding patterns in a Node.js and Express environment.
- SQL Injection Demo (
/sqli): A side-by-side comparison of a login form vulnerable to SQLi and a secure one using parameterized queries. - XSS Demo (
/xss): A comment/feedback section that demonstrates the difference between rendering raw user input (vulnerable to Stored XSS) and rendering sanitized input.
- Backend: Node.js, Express.js
- Database: SQLite
- Templating: EJS
- Node.js and npm installed.
-
Clone the repository (or download the source code).
-
Navigate to the project directory and install dependencies:
cd secure-dev-coffee npm install -
Initialize the database: This will create the
database/secure-coffee.dbfile and populate it with the necessary tables and seed data.npm run init-db
-
Start the server:
npm start
-
Access the application: Open your web browser and navigate to
http://localhost:3000.
This application intentionally contains vulnerable code for educational purposes. Do not use the vulnerable patterns demonstrated here in production applications. The primary goal is to illustrate how these vulnerabilities work and how to prevent them using secure coding practices (e.g., parameterized queries, output escaping).