Joplin Server hardening

Joplin Server enables one or more hardening options provided by Node.js. These options reduce attack surface and make it more difficult to exploit certain types of vulnerabilities.

How it works

Joplin Server's main entrypoint, index.ts calls a secondary entrypoint (app.ts) with certain NODE_OPTIONS set. If hardening is enabled, these NODE_OPTIONS currently include:

• --disable-proto=delete: Removes the deprecated __proto__ property. This makes prototype pollution attacks more difficult.