Building a Secure Node.js API: 10 Layers of Defense Against Modern Attacks

Layer 01: Perimeter Network

1. HTTPS (Transport Layer Security)

Threat Profile

MITM (Man-in-the-Middle) Attacks

Mitigation Mechanism

SSL/TLS 1.3 Encryption & HSTS

Encrypting data in transit protects against Man-in-the-Middle (MITM) attacks. Implement HSTS headers and redirect all HTTP traffic to HTTPS (preferably terminating at a reverse proxy like Nginx) to ensure all payload transmissions are fully secure.

server.js

// Force SSL and HSTS Headers using Express
const express = require('express');
const helmet = require('helmet');
const app = express();

// Redirect HTTP requests to HTTPS
app.use((req, res, next) => {
  if (req.secure || req.headers['x-forwarded-proto'] === 'https') {
    next();
  } else {
    res.redirect(301, `https://${req.headers.host}${req.url}`);
  }
});

// Configure HSTS (Strict Transport Security) via Helmet
app.use(helmet.hsts({
  maxAge: 31536000, // 1 year in seconds
  includeSubDomains: true,
  preload: true // Opt-in to browser preload lists
}));

Security Warning: Simply setting up HTTPS isn't enough. If your API serves both HTTP and HTTPS, make sure you employ HSTS headers and issue permanent 301 redirects, or disable the HTTP port entirely.

Layer 02: HTTP Header Hardening

2. Helmet (Secure HTTP Headers)

Threat Profile

Clickjacking, XSS, MIME Sniffing

Mitigation Mechanism

HTTP Header Injection Hardening

Helmet hardens HTTP response headers to defend against clickjacking, XSS, and MIME-type sniffing. It hides stack information like `X-Powered-By: Express` and enforces Content Security Policies (CSP) to restrict script loading origins.

app.js

// Hardening HTTP headers using Helmet middleware
const express = require('express');
const helmet = require('helmet');
const app = express();

// Disable standard fingerprinting and inject security headers
app.use(helmet({
  // Override Content Security Policy
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://trusted-cdn.com"],
      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
      imgSrc: ["'self'", "data:", "https://images.unsplash.com"],
      connectSrc: ["'self'", "https://api.yourdomain.com"],
      objectSrc: ["'none'"],
      upgradeInsecureRequests: [],
    },
  },
  // Prevent clickjacking
  frameguard: { action: 'deny' },
  // Block MIME Sniffing
  noSniff: true,
  // Strict Referrer Policy
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' }
}));

Security Warning: Standard Helmet presets may break local web integrations if you have custom scripts or assets. Always configure your Content Security Policy (CSP) precisely based on allowed domain hosts.

Layer 03: Browser Security Boundaries

3. CORS (Cross-Origin Resource Sharing)

Threat Profile

CSRF & Unauthorized Data Retrieval

Mitigation Mechanism

Strict Origin Whitelisting

Cross-Origin Resource Sharing controls which clients can query your API. A loose configuration (`*`) allows malicious sites to fetch data using a user's active session. Define a strict whitelist of trusted origins and credentials boundaries.

cors.js

// Configuring strict Cross-Origin Resource Sharing
const cors = require('cors');
const express = require('express');
const app = express();

const allowedOrigins = [
  'https://yourfrontend.com',
  'https://admin.yourfrontend.com'
];

const corsOptions = {
  origin: (origin, callback) => {
    // Allow server-to-server or local tests (origin is undefined)
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Rejected by security firewall: CORS Origin mismatch.'));
    }
  },
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true, // Only if sharing cookies/sessions
  optionsSuccessStatus: 200
};

app.use(cors(corsOptions));

Security Warning: Never use `Access-Control-Allow-Origin: *` in production on endpoints that handle state changes (POST, PUT, DELETE) or cookies. It allows arbitrary scripts on other sites to interact with your data.

Layer 04: Flow Control

4. Rate Limiting

Threat Profile

Brute Force & DDoS Attacks

Mitigation Mechanism

Request Limits by IP window

Rate limiting restricts the volume of requests from an IP window to block brute-force or DDoS attempts. Use a centralized Redis store in clustered environments to maintain accuracy across multiple server processes.

rateLimiter.js

// Implementing API Rate Limiting with redis-store
const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');
const Redis = require('ioredis');

const redisClient = new Redis(process.env.REDIS_URL);

const apiLimiter = rateLimit({
  store: new RedisStore({
    sendCommand: (...args) => redisClient.call(...args),
  }),
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per window
  message: {
    error: 'Too many requests. Please try again after 15 minutes.'
  },
  standardHeaders: true, // Return rate limit info in headers
  legacyHeaders: false,
});

// Apply rate limiter globally
app.use('/api/', apiLimiter);

Pro Tip: In cluster configurations (Kubernetes, multiple PM2 processes), in-memory rate limiters fail to track cumulative requests accurately. Use a central data store like Redis to persist rate limit metrics.

Layer 05: Application-Layer Threat Intelligence

5. Arcjet (Bot & Scraper Detection)

Threat Profile

Bots, Scrapers & automated credential stuffing

Mitigation Mechanism

Dynamic IP Fingerprinting & Behavior Audits

Standard IP limiters can be bypassed using distributed residential proxy networks. Arcjet runs application-layer bot detection and dynamic IP fingerprinting directly in your code, checking request behaviors before processing routes.

arcjet.js

// Integrate Arcjet Bot and Scraper Detection
const express = require('express');
const arcjet = require('@arcjet/node');
const app = express();

const aj = arcjet({
  key: process.env.ARCJET_KEY, // Set ARCJET_KEY env
  characteristics: ["ip.src"], // Track client request origin IP
  rules: [
    arcjet.detectBot({
      mode: "LIVE", // Reject malicious bots in real-time
      // Block general automated scrapers but allow friendly search indexers
      block: ["AUTOMATED", "AI"] 
    }),
    arcjet.rateLimit({
      mode: "LIVE",
      algorithm: "TOKEN_BUCKET",
      refillRate: 10,
      capacity: 50,
      interval: "1m"
    })
  ]
});

app.use(async (req, res, next) => {
  const decision = await aj.protect(req);

  if (decision.isDenied()) {
    return res.status(403).json({ 
      error: "Access Denied: Automated bots or request spike detected." 
    });
  }
  next();
});

Pro Tip: Arcjet lets you declare specific rules per endpoint (e.g. strict email audits on login/signup, but general bot protection on search blocks).

Layer 06: Data Sanitization

6. Request Validation (Injection Shield)

Threat Profile

SQL/NoSQL Injection, Command Injection

Mitigation Mechanism

Schema Validation via Zod

SQL, NoSQL, and Command Injection succeed when untrusted user input is passed directly to databases or shell scripts. Use schema validation libraries like Zod to validate payload shapes and sanitize types before execution.

validator.js

// Request Validation Schema using Zod
const { z } = require('zod');

// Schema for user signup input
const signupSchema = z.object({
  email: z.string().email({ message: "Invalid email syntax" }).trim(),
  password: z.string()
    .min(10, { message: "Password must be at least 10 chars long" })
    .max(100)
    .regex(/[A-Z]/, { message: "Require uppercase letter" })
    .regex(/[0-9]/, { message: "Require number" }),
  username: z.string().min(3).max(30).alphanumeric()
});

const validateRequest = (schema) => (req, res, next) => {
  const result = schema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({ 
      error: "Validation failed", 
      details: result.error.errors.map(err => err.message)
    });
  }
  req.validatedBody = result.data;
  next();
};

app.post('/api/signup', validateRequest(signupSchema), (req, res) => {
  // Safe sanitized payload is on req.validatedBody
});

Security Warning: NoSQL databases like MongoDB are also susceptible to injection attacks via operator manipulation (e.g. passing {"$gt": ""} instead of a string value). Validation schema checks completely resolve this.

Layer 07: Identity Authentication

7. Authentication (Identity Verification)

Threat Profile

Unauthorized Access & Session Hijacking

Mitigation Mechanism

Asymmetric Cryptographic Tokens (JWT RS256)

Authentication verifies requester identity. Implement JWT signature verification using asymmetric RS256 algorithms and enforce explicit signature checks to prevent public-key forgery and algorithm downgrade attacks.

auth.js

// Cryptographic Identity Verification (JWT RS256)
const jwt = require('express-jwt');
const jwksRsa = require('jwks-rsa');

const verifyJWT = jwt({
  // Dynamically fetch signing keys from auth server
  secret: jwksRsa.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://auth.yourdomain.com/.well-known/jwks.json`
  }),
  // Validate the audience and the issuer
  audience: 'https://api.yourdomain.com',
  issuer: 'https://auth.yourdomain.com/',
  algorithms: ['RS256'] // Block fallback to HS256/none
});

app.use('/api/protected', verifyJWT);

Security Warning: Always enforce strict signature checks on the backend. Explicitly set `algorithms: ["RS256"]` inside the verification config to prevent attackers from sending a custom token signed with symmetric HS256 using the public key as the secret.

Layer 08: Access Control

8. Authorization (Privilege Check & IDOR)

Threat Profile

Privilege Escalation & IDOR Attacks

Mitigation Mechanism

RBAC & Resource Ownership Verification

Ensure users only access resources they own. Implement Role-Based Access Control (RBAC) and database-level ownership validations to prevent Privilege Escalation and Insecure Direct Object Reference (IDOR) attacks.

acl.js

// RBAC and Insecure Direct Object Reference (IDOR) Protection
const checkRole = (allowedRoles) => (req, res, next) => {
  const { role } = req.user; // Appended by auth middleware
  if (!allowedRoles.includes(role)) {
    return res.status(403).json({ error: "Access Denied: Insufficient scope" });
  }
  next();
};

// IDOR prevention middleware checking data ownership
const checkResourceOwnership = async (req, res, next) => {
  const userId = req.user.id;
  const resourceId = req.params.id;

  const resource = await db.findOne({ id: resourceId });
  if (!resource) {
    return res.status(404).json({ error: "Resource not found" });
  }

  // Enforce access boundary
  if (resource.ownerId !== userId) {
    return res.status(403).json({ error: "Forbidden: Access token mismatch" });
  }

  req.resource = resource;
  next();
};

app.get('/api/document/:id', checkResourceOwnership, (req, res) => {
  res.json(req.resource);
});

Pro Tip: Always perform a resource-level ownership validation in database operations (e.g. `WHERE id = :id AND tenant_id = :tenant_id`) rather than just relying on generic route authorization.

Layer 09: Media Security

9. Secure Uploads (File Sandbox)

Threat Profile

Remote Code Execution (RCE), Zip Slip

Mitigation Mechanism

MIME-Type checks & Isolated Storage

File uploads are direct vectors for Remote Code Execution (RCE). Validate file extensions, size limits, and binary MIME-types. Stream uploaded files directly to isolated cloud storage instead of local application folders.

upload.js

// Secure file uploads using Multer and isolated configuration
const multer = require('multer');
const path = require('path');

const storage = multer.memoryStorage(); // Stream direct to cloud buffer

const upload = multer({
  storage: storage,
  limits: {
    fileSize: 5 * 1024 * 1024, // Strict 5MB file limit
  },
  fileFilter: (req, file, callback) => {
    // Validate extensions and mime-types
    const allowedExtensions = ['.png', '.jpg', '.jpeg', '.webp'];
    const allowedMimeTypes = ['image/png', 'image/jpeg', 'image/webp'];

    const fileExt = path.extname(file.originalname).toLowerCase();
    const isExtOk = allowedExtensions.includes(fileExt);
    const isMimeOk = allowedMimeTypes.includes(file.mimetype);

    if (isExtOk && isMimeOk) {
      callback(null, true);
    } else {
      callback(new Error('Security Error: Disallowed file extension.'));
    }
  }
});

Security Warning: Never host uploaded files on the same host domain as your API code. Storing uploads inside your public directory opens up path traversal risks. Always stream files directly to cloud object storage (like AWS S3 or Google Cloud Storage) and block public execution settings.

Layer 10: Event Audits

10. Monitoring & Structured Logging

Threat Profile

Undetected Breach & Delayed Audits

Mitigation Mechanism

Structured JSON Logging & SIEM

Structured JSON logs make it easy to audit security events and detect incidents. Ensure log payloads are sanitized to exclude passwords, access tokens, and Personally Identifiable Information (PII) before ingestion to SIEM tools.

logger.js

// Structured JSON Logging using Winston
const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json() // Output JSON format for log analyzers
  ),
  defaultMeta: { service: 'user-service' },
  transports: [
    new winston.transports.Console()
  ],
});

// Custom logger sanitizer middleware
app.use((req, res, next) => {
  logger.info({
    method: req.method,
    url: req.url,
    ip: req.ip,
    // NEVER log headers containing credentials, cookies or body passwords
  });
  next();
});

Security Warning: Logging everything can inadvertently expose credentials. Check for custom sanitizers that filter key terms like `password`, `token`, `secret`, and `authorization` in log bodies.

Hardening Your APIs for Production

Applying these ten layers establishes a rock-solid security foundation. Need a secure, high-performance back-end system custom built for your startup? Let's build it correctly.

Secure Your Stack

CHAND.

10 Security Layers

Visualizing the Defense-in-Depth Model

1. HTTPS (Transport Layer Security)

2. Helmet (Secure HTTP Headers)

3. CORS (Cross-Origin Resource Sharing)

4. Rate Limiting

5. Arcjet (Bot & Scraper Detection)

6. Request Validation (Injection Shield)

7. Authentication (Identity Verification)

8. Authorization (Privilege Check & IDOR)

9. Secure Uploads (File Sandbox)

10. Monitoring & Structured Logging

Hardening Your APIs for Production