Security Best Practices

1// Security Best Practices — Production Hardening
2
3const express = require("express");
4const helmet = require("helmet");
5const cors = require("cors");
6const rateLimit = require("express-rate-limit");
7
8const app = express();
9
10// 1. Helmet — Sets 15+ security headers
11app.use(helmet());
12// Includes: CSP, X-Content-Type-Options, X-Frame-Options, HSTS, etc.
13
14// 2. CORS — Restrict origins
15app.use(
16  cors({
17    origin: process.env.ALLOWED_ORIGINS?.split(",") || "http://localhost:3000",
18    methods: ["GET", "POST", "PUT", "DELETE"],
19    allowedHeaders: ["Content-Type", "Authorization"],
20    credentials: true,
21    maxAge: 86400, // Preflight cache (24 hours)
22  })
23);
24
25// 3. Rate limiting
26const apiLimiter = rateLimit({
27  windowMs: 15 * 60 * 1000, // 15 minutes
28  max: 100, // 100 requests per window per IP
29  standardHeaders: true,
30  legacyHeaders: false,
31  message: { error: "Too many requests, please try again later" },
32});
33app.use("/api/", apiLimiter);
34
35// Aggressive rate limiting for auth endpoints
36const authLimiter = rateLimit({
37  windowMs: 15 * 60 * 1000,
38  max: 10, // Only 10 login attempts per 15 minutes
39  message: { error: "Too many login attempts" },
40});
41app.use("/api/auth/login", authLimiter);
42
43// 4. Body size limit (prevent DoS)
44app.use(express.json({ limit: "10kb" }));
45
46// 5. NoSQL injection prevention
47function sanitizeInput(req, res, next) {
48  const sanitize = (obj) => {
49    for (const key in obj) {
50      if (typeof obj[key] === "string") {
51        // Remove MongoDB operators
52        obj[key] = obj[key].replace(/\$|\./g, "");
53      } else if (typeof obj[key] === "object" && obj[key] !== null) {
54        sanitize(obj[key]);
55      }
56    }
57  };
58  if (req.body) sanitize(req.body);
59  if (req.query) sanitize(req.query);
60  if (req.params) sanitize(req.params);
61  next();
62}
63app.use(sanitizeInput);
64
65// 6. SQL injection prevention (use parameterized queries)
66// ❌ VULNERABLE:
67// db.query(`SELECT * FROM users WHERE email = '${req.body.email}'`);
68// ✅ SAFE:
69// db.query("SELECT * FROM users WHERE email = $1", [req.body.email]);
70
71// 7. Password hashing with bcrypt
72const bcrypt = require("bcryptjs");
73
74async function hashPassword(plainPassword) {
75  const salt = await bcrypt.genSalt(12); // Cost factor 12
76  return bcrypt.hash(plainPassword, salt);
77}
78
79async function verifyPassword(plainPassword, hashedPassword) {
80  return bcrypt.compare(plainPassword, hashedPassword);
81}
82
83// 8. HTTP-only cookies for tokens
84function setTokenCookie(res, token) {
85  res.cookie("accessToken", token, {
86    httpOnly: true,    // Can't be accessed by JavaScript
87    secure: process.env.NODE_ENV === "production", // HTTPS only in production
88    sameSite: "strict", // No cross-site requests
89    maxAge: 15 * 60 * 1000, // 15 minutes
90    path: "/",
91  });
92}
93
94// 9. Input validation with express-validator
95// const { body, validationResult } = require("express-validator");
96// app.post("/api/users",
97//   body("email").isEmail().normalizeEmail(),
98//   body("name").trim().isLength({ min: 2, max: 50 }),
99//   body("password").isStrongPassword(),
100//   (req, res) => {
101//     const errors = validationResult(req);
102//     if (!errors.isEmpty()) {
103//       return res.status(400).json({ errors: errors.array() });
104//     }
105//     // ... create user
106//   }
107// );
108
109// 10. Security headers for API responses
110app.use((req, res, next) => {
111  res.removeHeader("X-Powered-By"); // Don't reveal Express
112  res.setHeader("X-Content-Type-Options", "nosniff");
113  res.setHeader("X-Frame-Options", "DENY");
114  res.setHeader("Cache-Control", "no-store"); // Prevent caching sensitive data
115  next();
116});
117
118// 11. Graceful error handling (never leak stack traces)
119app.use((err, req, res, next) => {
120  console.error("Error:", err); // Log full error internally
121
122  // Never send stack traces to clients in production
123  res.status(err.statusCode || 500).json({
124    error: process.env.NODE_ENV === "production"
125      ? "Internal server error"
126      : err.message,
127  });
128});
129
130app.listen(3000);