Node.js in a hidden service?

Question

Is it safe to use Node.js as the backend language of a hidden service?

Or is it a poor choice when compared to languages such as PHP and/or Python?

Answer 1

None of the 3 languages is perfectly safe. All of them have vulnerabilities that if an application is not developed following good programming practices, they can allow an attacker to exploit different weak points and gain access to the application and its data.

You can use any language you want, but you have to consider checking your application to see if it has vulnerabilities (you can use OWASP Testing Guide), here are some references that you may find useful, I selected references for the 3 languages you mentioned above.

PHP:

• https://www.wordfence.com/learn/understanding-php-vulnerabilities/
• https://www.sitepoint.com/top-10-php-security-vulnerabilities/
• https://medium.com/@pentster/high-risk-vulnerabilities-in-php-web-applications-a38a75627a75

NodeJS:

• https://keenethics.com/blog/nodejs-security
• https://www.synopsys.com/blogs/software-security/nodejs-mean-stack-vulnerabilities/
• https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html

Python:

• https://stackabuse.com/checking-vulnerabilities-in-your-python-code-with-bandit
• https://itnext.io/common-python-security-problems-ffedbae7b11c
• https://www.tripwire.com/state-of-security/vulnerability-management/digging-for-security-bugs-vulnerabilities-in-python-applications/