Securing an Express API: A Practical Checklist

Security is mostly about covering the basics consistently. Run through this list on every API you ship.

1. Set secure headers

helmet sets headers that reduce common attacks such as clickjacking and MIME sniffing.

app.use(helmet());

2. Rate limit

Limit requests per IP, with a much stricter limit on login and password reset routes. This slows brute force attacks and abusive scraping.

3. Validate every input

Parse body, query and params with a schema library like Zod and reject anything unexpected. Never trust the client, even your own frontend.

4. Configure CORS narrowly

Allow only your real frontend origins and set credentials: true only when you use cookies. A wildcard origin with credentials is a serious mistake.

5. Hash passwords

Use bcrypt or argon2. Never log passwords or tokens, and never return password hashes in a response.

6. Protect against injection

Use an ORM or parameterized queries. For MongoDB, validate types so a request cannot send an object where a string is expected and bypass a filter.

7. Limit payload size

Set a body size limit, for example express.json({ limit: '1mb' }), to avoid memory exhaustion.

8. Keep secrets out of code

Store secrets in environment variables, never in git. Rotate any secret that has been exposed.

9. Handle errors safely

In production, return a generic message and log details on the server. Stack traces help attackers.

10. Audit dependencies

Run npm audit regularly and keep packages updated. Remove libraries you no longer use.

Takeaway

Headers, rate limits, validation, tight CORS, hashed passwords and careful secrets. Do these on every project and most attacks fail.