How pamith596/nodegoat-devsecops works
NodeGoat is a web application for learning OWASP Top 10 risks by using a deliberately vulnerable personal-finance app alongside tutorial material. The main flow is browser request → Express route/session handling → domain handler → MongoDB DAO → rendered page or response. Domain branches cover accounts, profiles, contributions, benefits, allocations, memos, and research; a separate tutorial route serves learning pages. The supplied source confirms several handler-to-DAO links and the research route's outbound HTTP request; other documented modules are included, but their internal calls are not asserted where excerpts do not show them.
Main entry points: index.js Route registry · session.js Accounts and sessions · server.js Express server · profile.js Profile handler
Components 23
Web and sessions
- Express server
server.js - Route registry
app/routes/index.js - Accounts and sessions
app/routes/session.js - Login and signup views
app/views
Finance features
- Profile handler
app/routes/profile.js - Contributions handler
app/routes/contributions.js - Benefits handler
app/routes/benefits.js - Allocations handler
app/routes/allocations.js - Memos handler
app/routes/memos.js - Finance views
app/views
Data access
- User data
app/data/user-dao.js - MongoDB
- Profile data
app/data/profile-dao.js - Contributions data
app/data/contributions-dao.js - Benefits data
app/data/benefits-dao.js - Allocations data
app/data/allocations-dao.js - Memos data
app/data/memos-dao.js - Research data
app/data/research-dao.js
Learning and research
- Research handler
app/routes/research.js - OWASP tutorial
app/routes/tutorial.js - Tutorial pages
app/views/tutorial
Other components
- Browser user
- Market data service
Connections 27
- Browser user → Express server: sends requests
README.md - Express server → MongoDB: connects to
server.js - Express server → Route registry: registers routes
server.js - Route registry → Accounts and sessions: dispatches auth
app/routes/index.js - Route registry → Profile handler: dispatches profile
app/routes/index.js - Route registry → Contributions handler: dispatches contributions
app/routes/index.js - Route registry → Benefits handler: dispatches benefits
app/routes/index.js - Route registry → Allocations handler: dispatches allocations
app/routes/index.js - Route registry → Memos handler: dispatches memos
app/routes/index.js - Route registry → Research handler: dispatches research
app/routes/index.js - Route registry → OWASP tutorial: mounts tutorial
app/routes/index.js - Accounts and sessions → User data: validates accounts
app/routes/session.js - Accounts and sessions → Allocations data: prepares allocations
app/routes/session.js - Profile handler → Profile data: reads and updates
app/routes/profile.js - Contributions handler → Contributions data: reads and updates
app/routes/contributions.js - Benefits handler → Benefits data
app/routes/benefits.js - Allocations handler → Allocations data
app/routes/allocations.js - Memos handler → Memos data
app/routes/memos.js - Research handler → Research data: constructs DAO
app/routes/research.js - Research handler → Market data service: requests market data
app/routes/research.js - User data → MongoDB: reads and writes
app/data/user-dao.js - Profile data → MongoDB: reads and writes
app/data/profile-dao.js - Allocations data → MongoDB: reads and writes
app/data/allocations-dao.js - OWASP tutorial → Tutorial pages: serves pages
README.md - Profile handler → Finance views: renders profile
app/routes/profile.js - Contributions handler → Finance views: renders contributions
app/routes/contributions.js - Accounts and sessions → Login and signup views: renders account pages
app/routes/session.js