Define what the process is allowed to do
A Node.js service can read files, open network connections, start child processes, and load native modules. Run it as a dedicated non-root account with access only to required files and services. In supported Node.js versions, consider the permission model to restrict filesystem, network, child-process, and native-addon capabilities. Container isolation is useful, but it does not replace least privilege inside the container.
Keep secrets in protected deployment configuration or a secret manager. Use separate credentials for each environment and service, grant narrow database and cloud permissions, and rotate them deliberately. Never place privileged credentials in client bundles, repository history, logs, or error responses.
Control HTTP parsing and resource use
Put a maintained reverse proxy or edge service in front of the application and configure both layers intentionally. Set limits for headers, request bodies, uploads, connections, and expensive operations. Configure headersTimeout, requestTimeout, keep-alive behaviour, and socket limits for the application’s workload. The official Node.js security best-practices guide highlights timeouts and reverse proxies as important denial-of-service mitigations.
Use rate limits for authentication, password recovery, search, exports, AI calls, and other costly endpoints. Bound concurrency for background tasks and outbound requests. Avoid catastrophic regular expressions and synchronous CPU- or filesystem-heavy work on request paths.
Validate requests and authorize every action
Validate parameters, query values, headers, JSON bodies, and uploaded files with explicit schemas. Reject unexpected content types and set maximum parsing sizes before parsing. Avoid unsafe object merging and protect against prototype-pollution properties.
Authentication identifies a principal; authorization decides whether that principal can perform this operation on this object. Centralize permission rules where practical and test cross-user and cross-tenant access. Use secure session cookies or carefully designed tokens, short-lived recovery links, CSRF protection where cookies are automatic, and replay controls for sensitive webhooks.
Configure Express deliberately
Disable unnecessary framework identification, use a security-header middleware as a starting point, then verify each header in production. Set CORS to known origins, credentials, methods, and headers rather than reflecting arbitrary input. Trust proxy headers only when requests actually arrive through known proxies; a broad trust proxy setting can let clients spoof protocol or address information.
Return generic client errors while logging a request identifier and useful internal context. Do not log passwords, session identifiers, API keys, complete payment data, or unnecessary request bodies. Handle rejected promises and process failures predictably, and restart through an orchestrator rather than trying to continue after unknown corrupted state.
Reduce supply-chain exposure
Keep a lockfile and use npm ci in continuous integration. Review new dependencies, lifecycle scripts, maintainer changes, and large transitive trees. Use vulnerability scanning, secret scanning, and reproducible build practices. Consider a short dependency release-age policy for routine installs, while maintaining a documented exception path for urgent security fixes.
Separate development dependencies and production artifacts. Do not deploy test credentials, local .env files, package-manager caches, or source maps that expose sensitive internals. Subscribe to Node.js and framework security advisories, and stay on supported releases.
Node.js and Express review checklist
- The process runs without root and has only required OS and cloud permissions.
- HTTP sizes, timeouts, rates, and outbound calls are bounded.
- Inputs are schema-validated and permissions are checked server-side.
- Proxy trust, CORS, cookies, CSRF, and security headers are explicit.
- Dependencies are locked, reviewed, scanned, and updated on a defined cadence.
- Logs support detection without collecting secrets or excessive personal data.
- Backups, rollback, incident contacts, and production monitoring are tested.
