Security
Security articles for Node.js service fleets: encrypting the Redis broker connection with TLS, least-privilege Redis ACL users for a message queue, and checking a caller's IP against thousands of allowed networks.
3 articles
Least privilege for your Redis broker: the ACL a Node.js service fleet actually needs
TLS decides who can listen to your broker. It says nothing about what a connected process may do after it is in — and on a Redis left at its defaults the answer is everything, including FLUSHALL. Here is the exact rule set an @imqueue fleet needs, the permissions that look optional and quietly are not, and how to rotate the password without a restart storm. Every behaviour is measured.
read →Meeting compliance: how to talk to your Redis broker over TLS
The questionnaire asks whether data is encrypted in transit, and you know the answer for the edge. Then you remember the broker — the one connection every service holds open all day, carrying every argument and every return value, and speaking a protocol that puts them on the wire as text. Here is what encrypting it takes, what it costs, and the two places it is easy to get wrong.
read →Checking an IP against 10,000 networks without comparing it to 10,000 networks
Every request asks the same question — is this one of ours? — and the loop you wrote to answer it gets slower every time someone adds a partner range. Here is how to answer it in logarithmic time instead, what an address really is once you stop treating it as a string, and the quiet precondition that a fast implementation must uphold or it will lie to you.
read →