securing-nodejs-apps

name	securing-nodejs-apps
description	Hardens Node.js HTTP services: input validation, secure headers, authentication/authorization basics, secret handling, and dependency hygiene. Use when shipping to production or reviewing a service for security gaps.

Securing Node.js Apps

When to use

• Shipping a service to production
• Reviewing a service for security gaps
• Adding authentication/authorization
• Handling secrets properly

Core rules

1. Input validation on all external boundaries (class-validator or Zod)
2. Secure headers: Helmet or equivalent
3. Secrets in env vars, never in code or logs
4. Authentication/authorization as ports, not hardcoded
5. Dependency hygiene: npm audit, no known vulnerabilities
6. Rate limiting on public endpoints

Reference shape (TypeScript)

Input Validation (Zod)

import { z } from 'zod';

export const CreateUserSchema = z.object({
  email: z.string().email().toLowerCase(),
  password: z.string().min(12),
  name: z.string().min(2).max(100),
});

export type CreateUserDto = z.infer<typeof CreateUserSchema>;

Secret Handling

// ❌ Never
const jwtSecret = 'my-secret';

// ✅ Always
import { config } from '@shared/config';
const jwtSecret = config.JWT_SECRET; // Loaded once, validated

Examples — Do

// Validate input at boundary
const parsed = CreateUserSchema.safeParse(req.body);
if (!parsed.success) return res.status(400).json({ errors: parsed.error.format() });

Examples — Don't

// ❌ No validation
app.post('/user', (req, res) => { db.save(req.body); });
// ❌ Secret in code
const apiKey = 'sk_live_12345';

Checklist

• Input validation on all boundaries
• Secure headers (Helmet)
• Secrets in env vars only
• Auth as injectable port
• Rate limiting configured
• npm audit passes

See reference/security-patterns.md for full patterns.