Node.js Security
Hardening Guide

$ npm install express-rate-limit express-slow-down

const rateLimit = require('express-rate-limit');
const slowDown  = require('express-slow-down');

// ─── General API limiter: 100 req / 15 min per IP ────────────
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,   // 15 minutes
  max:      100,
  standardHeaders: true,
  legacyHeaders:   false,
  message: { error: 'Too many requests. Try again later.' },
  skipSuccessfulRequests: false,
});

// ─── Auth limiter: 5 attempts / 15 min (strict) ──────────────
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max:      5,
  standardHeaders: true,
  legacyHeaders:   false,
  message: { error: 'Too many login attempts. Wait 15 minutes.' },
  skipSuccessfulRequests: true,   // don't penalise successful logins
});

// ─── Speed limiter: slow-down after 50 requests ──────────────
const speedLimiter = slowDown({
  windowMs:        15 * 60 * 1000,
  delayAfter:      50,
  delayMs:         (hits) => hits * 100,   // +100ms per hit
});

module.exports = { apiLimiter, authLimiter, speedLimiter };

const { apiLimiter, authLimiter, speedLimiter } = require('./src/middleware/rateLimit');

// Global API rate limit
app.use('/api/', apiLimiter);
app.use('/api/', speedLimiter);

// Strict auth endpoint limits
app.use('/api/auth/login',    authLimiter);
app.use('/api/auth/register', authLimiter);
app.use('/api/auth/reset',    authLimiter);

# Rate limit zones
limit_req_zone  $binary_remote_addr zone=api_zone:10m rate=30r/s;
limit_req_zone  $binary_remote_addr zone=login_zone:10m rate=3r/m;
limit_conn_zone $binary_remote_addr zone=conn_zone:10m;

$ npm install cors

const cors = require('cors');

// ─── Strict origin allowlist ──────────────────────────────────
const ALLOWED_ORIGINS = [
  'https://your-app.com',
  'https://www.your-app.com',
  'https://admin.your-app.com',
  // Dev only — NEVER in production:
  ...(process.env.NODE_ENV === 'development' ? ['http://localhost:3000'] : []),
];

const corsOptions = {
  origin: (origin, callback) => {
    // Allow requests with no origin (server-to-server / curl)
    if (!origin) return callback(null, true);
    if (ALLOWED_ORIGINS.includes(origin)) {
      return callback(null, true);
    }
    callback(new Error(`CORS blocked: ${origin}`));
  },
  credentials: true,    // allow cookies in cross-origin requests
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
  allowedHeaders: ['Content-Type', 'Authorization', 'X-Request-ID'],
  exposedHeaders: ['X-Request-ID'],
  maxAge: 86400,         // cache preflight for 24 hours
  optionsSuccessStatus: 200,
};

module.exports = cors(corsOptions);

const corsMiddleware = require('./src/middleware/cors');
// Handle OPTIONS preflight first
app.options('*', corsMiddleware);
// Apply to all routes
app.use(corsMiddleware);

# Install certbot
$ apt-get install certbot python3-certbot-nginx -y

# Issue certificate (replaces Nginx config automatically)
$ certbot --nginx -d your-app.com -d www.your-app.com \
  --email admin@your-app.com --agree-tos --no-eff-email

# Auto-renewal (already set up by certbot, verify it)
$ systemctl status certbot.timer
$ certbot renew --dry-run