Node.js — Security

Helmet

npm install helmet

const helmet = require('helmet');
app.use(helmet());

CORS

npm install cors

const cors = require('cors');
app.use(cors({
    origin: 'https://example.com',
    methods: ['GET', 'POST'],
    credentials: true
}));

Rate Limiting

npm install express-rate-limit

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 100
});

app.use('/api/', limiter);

Input Validation

const Joi = require('joi');

const schema = Joi.object({
    email: Joi.string().email().required(),
    password: Joi.string().min(8).required()
});

const { error } = schema.validate(req.body);

Security Headers

app.use(helmet.contentSecurityPolicy({
    directives: {
        defaultSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"]
    }
}));

Best Practices

Practice	Description
Use HTTPS	Encrypt data
Validate input	Prevent injection
Use rate limiting	Prevent abuse
Hash passwords	Protect credentials
Keep dependencies updated	Fix vulnerabilities

Mini Practice

1. Add Helmet middleware
2. Configure CORS
3. Implement rate limiting
4. Validate user input

Up Next

Continue with Deployment — deploying Node.js apps.