Security Best Practices

Hardening an Express app for production - secure headers with Helmet, rate limiting, CORS done correctly, and the most common Express security mistakes.

What it is, in plain English: Security in Express means defending against the common attack patterns every public web server faces: setting secure HTTP headers (Helmet), limiting how many requests a client can make (rate limiting), correctly restricting which origins can call your API (CORS), and following the general JavaScript security principles -- input validation, output escaping, never trusting client data -- applied specifically to a server context.

Hardening a server before it goes live

Helmet -- secure headers in one line

// npm install helmet
import helmet from "helmet";

app.use(helmet());
// Sets ~11 security-related HTTP headers automatically:
// X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security,
// Content-Security-Policy, Referrer-Policy, and more.
// This single line is the highest-value, lowest-effort security improvement
// you can make to any Express app.

Rate limiting -- stopping abuse

// npm install express-rate-limit
import rateLimit from "express-rate-limit";

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,   // 15 minute window
  max: 100,                    // max 100 requests per IP per window
  message: "Too many requests, please try again later",
});

app.use(limiter);   // applies globally

// Stricter limits on sensitive routes (login is a common brute-force target):
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,   // only 5 login attempts per 15 minutes
});
app.post("/login", loginLimiter, loginHandler);

CORS -- controlling who can call your API

// npm install cors
import cors from "cors";

// ✗ Allowing everyone (only OK for fully public APIs):
app.use(cors());   // Access-Control-Allow-Origin: *

// ✓ Restricting to known origins (almost always what you want):
app.use(cors({
  origin: ["https://myapp.com", "https://admin.myapp.com"],
  credentials: true,   // allow cookies to be sent cross-origin
}));

// Per-route CORS (different rules for different endpoints):
app.get("/public-data", cors(), handler);                     // open
app.get("/private-data", cors({ origin: "https://myapp.com" }), handler);  // restricted

The basic security checklist

// 1. app.use(helmet())                 -- secure headers
// 2. app.use(rateLimit({...}))          -- prevent abuse
// 3. app.use(cors({ origin: [...] }))   -- restrict cross-origin access
// 4. Validate ALL input (see Validation page)
// 5. Never log sensitive data (passwords, tokens, card numbers)
// 6. Use HTTPS in production (terminate TLS at a load balancer or use Let's Encrypt)
// 7. Keep dependencies updated -- npm audit regularly
// 8. Store secrets in environment variables, never in code

Try It Yourself (Node.js logic)

// Express security essentials -- demonstrated as runnable logic + reference code

// 1. RATE LIMITING -- the algorithm, simplified (express-rate-limit does this for real):
function createRateLimiter(maxRequests, windowMs) {
  const requests = new Map();  // IP -> array of timestamps

return function checkLimit(ip) {
    const now = Date.now();
    const timestamps = (requests.get(ip) || []).filter(t => now - t < windowMs);

if (timestamps.length >= maxRequests) {
      return { allowed: false, retryAfter: windowMs - (now - timestamps[0]) };
    }

timestamps.push(now);
    requests.set(ip, timestamps);
    return { allowed: true, remaining: maxRequests - timestamps.length };
  };
}

const limiter = createRateLimiter(3, 10000);  // 3 requests per 10 seconds

console.log("Simulating 5 rapid requests from the same IP:");
for (let i = 1; i <= 5; i++) {
  const result = limiter("192.168.1.1");
  console.log(`Request ${i}:`, result.allowed ? `Allowed (${result.remaining} left)` : "BLOCKED");
}

// 2. SECURITY HEADERS reference (Helmet sets these automatically):
const securityHeaders = {
  "X-Content-Type-Options":   "nosniff      -- prevents MIME-type sniffing",
  "X-Frame-Options":          "DENY         -- prevents clickjacking",
  "Strict-Transport-Security":"max-age=...  -- forces HTTPS",
  "Content-Security-Policy":  "default-src 'self' -- restricts resource origins",
  "Referrer-Policy":          "no-referrer  -- limits referrer leakage",
};
console.log("\nSecurity headers Helmet sets automatically:");
Object.entries(securityHeaders).forEach(([h,d]) => console.log(`  ${h}: ${d}`));

// THE REAL SETUP CODE:
const SETUP_CODE = `
import helmet from "helmet";
import rateLimit from "express-rate-limit";
import cors from "cors";

app.use(helmet());   // sets ~11 security headers with one call

app.use(rateLimit({
  windowMs: 15 * 60 * 1000,   // 15 minutes
  max: 100,                    // limit each IP to 100 requests per window
  message: "Too many requests, please try again later",
}));

app.use(cors({
  origin: ["https://myapp.com"],   // ONLY this origin can call the API
  credentials: true,
}));
`;
console.log("\nReal Express security middleware setup:");
console.log(SETUP_CODE.trim());

CSRF, SQL injection prevention, and secret management

CSRF protection for cookie-based auth

// CSRF matters when using SESSION/COOKIE auth (not JWT in an Authorization header --
// JWT in headers is naturally CSRF-resistant since browsers don't auto-attach headers):

// Modern approach: SameSite cookies (often sufficient alone):
app.use(session({
  cookie: { sameSite: "strict", secure: true, httpOnly: true },
}));

// Additional CSRF token verification for extra defense-in-depth:
// npm install csrf-csrf (csurf is deprecated)
import { doubleCsrf } from "csrf-csrf";
const { generateToken, doubleCsrfProtection } = doubleCsrf({ getSecret: () => process.env.CSRF_SECRET });

app.get("/form", (req, res) => {
  const token = generateToken(req, res);
  res.json({ csrfToken: token });   // client includes this in subsequent POST
});
app.post("/submit", doubleCsrfProtection, handler);

SQL injection -- prevented by parameterized queries

// ✗ NEVER build SQL with string concatenation:
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
// If req.body.email = "x' OR '1'='1" -- this returns ALL users!

// ✓ ORMs (Prisma, Mongoose) parameterize automatically:
await prisma.user.findUnique({ where: { email: req.body.email } });   // safe

// ✓ Raw SQL with parameterized placeholders (if you must):
await pool.query("SELECT * FROM users WHERE email = $1", [req.body.email]);
// The driver sends the value SEPARATELY from the query structure --
// it can never be interpreted as SQL syntax, no matter what it contains.

Secrets management

// npm install dotenv
import "dotenv/config";   // loads .env into process.env

// .env (NEVER commit this -- add to .gitignore):
// DATABASE_URL=postgresql://...
// JWT_SECRET=a-long-random-string
// STRIPE_SECRET_KEY=sk_live_...

const secret = process.env.JWT_SECRET;
if (!secret) {
  throw new Error("JWT_SECRET environment variable is required");
  // fail fast at startup rather than silently using 'undefined' as a secret
}

Production security checklist and dependency auditing

// Hide Express's fingerprint (reduces automated attack targeting):
app.disable("x-powered-by");   // helmet() also does this automatically

// Trust proxy -- required when behind a reverse proxy/load balancer
// for req.ip and rate limiting to see the REAL client IP, not the proxy's:
app.set("trust proxy", 1);   // trust first proxy hop

// Request size limits -- prevent memory exhaustion from huge bodies:
app.use(express.json({ limit: "1mb" }));

// Dependency auditing -- part of CI, not a one-time check:
// npm audit
// npm audit fix
// Consider: npm audit --audit-level=high in CI to fail builds on serious vulns

// Security-focused npm packages worth knowing:
// helmet              -- secure headers
// express-rate-limit  -- rate limiting
// express-mongo-sanitize -- strips MongoDB operator injection ($gt, $ne, etc.) from input
// hpp                 -- protects against HTTP parameter pollution

NoSQL injection — a MongoDB-specific risk

MongoDB queries built from unsanitized request bodies are vulnerable to a NoSQL injection variant: if a client sends {"email": {"$gt": ""}} instead of a plain string, and that's passed directly into a Mongoose query, MongoDB interprets the object as a query operator rather than a literal value to match — potentially bypassing authentication checks entirely. express-mongo-sanitize strips keys starting with $ or containing . from request data before it reaches your handlers, closing this specific hole. This is a reminder that "use an ORM" alone doesn't guarantee safety — always validate the SHAPE of input (Zod, as covered earlier) in addition to relying on the database layer's parameterization.

Official Sources

The Codex links only to official documentation. No third-party tutorials.