Security Best Practices in Node.js

Security in Node.js applications focuses on protecting data, users, and servers from common vulnerabilities and attacks.
Following best practices ensures confidentiality, integrity, and availability of your application.

1. Keep Dependencies Secure

• Regularly update Node.js and npm packages

• Remove unused dependencies

• Use npm audit to find vulnerabilities

npm audit fix

2. Use Environment Variables for Secrets

Never hardcode sensitive data.

process.env.DB_PASSWORD

✔ Store secrets in .env or cloud secret managers

3. Validate and Sanitize User Input

Prevent attacks like SQL injection and XSS.

• Use validation libraries (joi, express-validator)

• Sanitize input data

body('email').isEmail();

4. Secure HTTP Headers

Use Helmet to set security headers.

npm install helmet

const helmet = require('helmet');
app.use(helmet());

5. Protect Against Cross-Site Scripting (XSS)

• Escape user input

• Use Content Security Policy (CSP)

• Avoid sending raw HTML

6. Prevent SQL / NoSQL Injection

• Use parameterized queries

• Use ORM/ODM tools (Sequelize, Mongoose)

User.findOne({ email });

7. Authentication and Password Security

• Hash passwords using bcrypt

• Use JWT or sessions

• Set token expiration

bcrypt.hash(password, 12);

8. Enable HTTPS

• Use SSL/TLS certificates

• Redirect HTTP to HTTPS

• Secure cookies

9. Implement Rate Limiting

Protect against brute-force attacks.

npm install express-rate-limit

app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
}));

10. Handle Errors Safely

• Do not expose stack traces to users

• Log errors internally

res.status(500).json({ error: 'Internal server error' });

11. Use CORS Properly

Restrict allowed origins.

app.use(cors({ origin: 'https://example.com' }));

12. Secure File Uploads

• Validate file types

• Limit file size

• Rename uploaded files

• Store outside public folders

13. Protect Against CSRF Attacks

• Use CSRF tokens

• SameSite cookies

14. Use a Process Manager

Use PM2 to:

• Restart apps on crashes

• Monitor logs

• Prevent downtime

15. Apply the Principle of Least Privilege

• Limit database permissions

• Restrict API access

• Use role-based access control

16. Common Security Mistakes

❌ Hardcoding secrets
❌ Allowing unlimited requests
❌ Ignoring dependency vulnerabilities
❌ Exposing internal errors

17. Security Checklist

✔ HTTPS enabled
✔ Input validated
✔ Secrets secured
✔ Rate limiting applied
✔ Dependencies updated

18. Summary

• Security is a continuous process

• Node.js apps need protection at every layer

• Use proven libraries and patterns

• Regular audits reduce risks