Instrucciones de origen · Vista previa de solo lectura
name
security-express
description
Review Express.js security audit patterns for middleware and routes. Use for auditing Helmet.js, CORS, body-parser limits, and auth middleware. Use proactively when reviewing Express.js apps.
Examples:
- user: "Secure my Express app" → add Helmet.js and disable x-powered-by
- user: "Check Express CORS config" → verify origin allowlists and credentials
- user: "Review Express auth middleware" → check route order and coverage
- user: "Scan for Express path traversal" → verify path normalization and validation
- user: "Audit Express session config" → check secure, httpOnly, and sameSite flags
Security audit patterns for Express.js applications covering essential security middleware, CORS configuration, auth patterns, and common vulnerabilities.
// ❌ Wrong order - static files before auth
app.use(express.static('uploads')); // Exposed!
app.use(requireAuth);
// ✓ Auth before protected static files
app.use('/public', express.static('public')); // Intentionally public
app.use(requireAuth);
app.use('/uploads', express.static('uploads')); // Now protected
Router-Level Auth Gaps
// Check: Is auth applied to all routes in admin router?const adminRouter = express.Router();
adminRouter.use(requireAuth); // Applied to all routes below
adminRouter.get('/users', getUsers);
adminRouter.delete('/users/:id', deleteUser);
// ❌ Watch for routes defined BEFORE the middlewareconst apiRouter = express.Router();
apiRouter.get('/health', getHealth); // No auth (intentional?)
apiRouter.use(requireAuth);
apiRouter.get('/users', getUsers); // Has auth
Common Vulnerabilities
SQL/NoSQL Injection
// ❌ String interpolationconst user = await db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
// ✓ Parameterized queryconst user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
// ❌ MongoDB injectionconst user = awaitUser.findOne({ email: req.body.email }); // If email is { $gt: "" }// ✓ Validate input typeif (typeof req.body.email !== 'string') return res.status(400).json({ error: 'Invalid email' });
