Express.js Security Best Practices

# CHAPTER 16

Express.js Security Best Practices #

1. Introduction #

2. Learning Objectives #

• Secure HTTP headers automatically using Helmet.js.

• Protect your API from unauthorized domains using CORS.

• Mitigate Brute Force and DoS attacks using Rate Limiting.

• Prevent NoSQL Injection attacks.

3. Beginner-Friendly Explanation #

• Helmet.js: The bakery's windows are currently transparent. Thieves can look inside and see exactly what brand of cash register you use (which helps them plan a robbery). Helmet puts up tinted windows, hiding your server's technical details.

• CORS: Someone builds a fake bakery next door that secretly pipes orders into your kitchen without permission. CORS is a VIP list at the door that ensures orders are ONLY accepted from your official website.

• Rate Limiting: A malicious rival sends 10,000 robots to stand in line and order one cookie each. Real customers cannot get in. The bakery crashes. Rate limiting sets a rule: "Only 100 cookies per person, per hour." The robots are banned.

4. Step 1: Securing HTTP Headers (Helmet.js) #

Install: npm install helmet

In index.js:

const helmet = require('helmet');

// Run this at the very top of your middleware stack
app.use(helmet());

*That single line of code fixes dozens of subtle security vulnerabilities.*

5. Step 2: Cross-Origin Resource Sharing (CORS) #

Install: npm install cors

In index.js:

const cors = require('cors');

// Allow ONLY your official frontend to communicate with the API
const corsOptions = {
    origin: 'https://www.myofficialwebsite.com',
    optionsSuccessStatus: 200
};

app.use(cors(corsOptions));

6. Step 3: Rate Limiting #

Install: npm install express-rate-limit

In index.js:

const rateLimit = require('express-rate-limit');

// Define the rule
const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes window
    max: 100, // Limit each IP to 100 requests per windowMs
    message: "Too many requests from this IP, please try again after 15 minutes"
});

// Apply globally to all requests
app.use(limiter);

// Or, apply strictly to the login route to prevent brute-force
// app.use('/api/login', limiter);

7. Step 4: NoSQL Injection Prevention (Data Sanitization) #

Install: npm install express-mongo-sanitize

In index.js:

const mongoSanitize = require('express-mongo-sanitize');

// This automatically intercepts req.body, req.query, and req.params,
// and completely strips out any prohibited MongoDB operators (like $)
app.use(mongoSanitize());

8. Backend Workflow: The Complete Security Stack #

const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const mongoSanitize = require('express-mongo-sanitize');

const app = express();

// 1. Security Headers
app.use(helmet());
// 2. CORS
app.use(cors({ origin: 'https://mysite.com' }));
// 3. Rate Limiting
app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));
// 4. Body Parser
app.use(express.json());
// 5. Data Sanitization (Must be AFTER body parser)
app.use(mongoSanitize());

// Routes go here...

9. Best Practices #

• Never Commit .env Files: The biggest security breach in Node.js history is developers accidentally uploading their .env files to public GitHub repositories. Bots scrape GitHub 24/7. If they find your database password, your infrastructure will be hijacked and deleted in seconds. ALWAYS ensure .env is inside your .gitignore file.

10. Common Mistakes #

• Applying CORS blindly: Beginners often get a red "CORS Error" in their frontend console, panic, and install app.use(cors()) with no options. This puts a wildcard * on the API, meaning *any website on earth* is now legally allowed to make requests to your API and steal data. Always restrict origin in production.

11. Exercises #

1. 1. Explain how a Brute Force attack works against a /login endpoint, and how express-rate-limit mitigates it.

12. Coding Challenges #

• Challenge: Configure a specialized Rate Limiter meant only for password resets. It should only allow 3 requests per IP address every 1 hour. Apply it to a mock POST route /api/forgot-password.

13. MCQs with Answers #

14. Interview Questions #

• Q: What is CORS, and why is it a crucial security feature enforced by web browsers? How do you configure an Express API to handle it securely?

• Q: Walk me through your standard security middleware stack in an index.js file. What packages do you use, and in what specific order do you place them?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #