securing-nodejs-apps

# Securing Node.js Apps ## When to use - Shipping a service to production - Reviewing a service for security gaps - Adding authentication/authorization - Handling secrets properly ## Core rules 1. Input validation on all external boundaries (class-validator or Zod) 2. Secure headers: Helmet or equivalent 3. Secrets in env vars, never in code or logs 4. Authentication/authorization as ports, not hardcoded 5. Dependency hygiene: `npm audit`, no known vulnerabilities 6. Rate limiting on public endpoints ## Reference shape (TypeScript) ### Input Validation (Zod) ```typescript import { z } from 'zod'; export const CreateUserSchema = z.object({ email: z.string().email().toLowerCase(), password: z.string().min(12), name: z.string().min(2).max(100), }); export type CreateUserDto = z.infer<typeof CreateUserSchema>; ``` ### Secret Handling ```typescript // ❌ Never const jwtSecret = 'my-secret'; // ✅ Always import { config } from '@shared/config'; const jwtSecret = config.JWT_SECRET; // Loaded once, validated ``` ## Examples — Do ```typescript // Validate input at boundary const parsed = CreateUserSchema.safeParse(req.body); if (!parsed.success) return res.status(400).json({ errors: parsed.error.format() }); ``` ## Examples — Don't ```typescript // ❌ No validation app.post('/user', (req, res) => { db.save(req.body); }); // ❌ Secret in code const apiKey = 'sk_live_12345'; ``` ## Checklist - [ ] Input validation on all boundaries - [ ] Secure headers (Helmet) - [ ] Secrets in env vars only - [ ] Auth as injectable port - [ ] Rate limiting configured - [ ] `npm audit` passes See [reference/security-patterns.md](./reference/security-patterns.md) for full patterns.