ExpressJS Security Practices

• XSS (Cross-Site Scripting) Injecting malicious scripts into web pages.
• CSRF (Cross-Site Request Forgery) Tricking users into performing unwanted actions.
• SQL/NoSQL Injection Injecting malicious database queries.
• Brute Force Attacks Trying many passwords to guess credentials.
• Man-in-the-Middle Intercepting communication between client and server.
• DDoS Overwhelming server with requests.

npm install helmet

const helmet = require('helmet');
app.use(helmet());

• Use Helmet to set proper headers.
• Escape user input when rendering HTML (templating engines do this automatically).
• Use <%= %> in EJS (escapes HTML) instead of <%- %> (raw).
• Validate and sanitize all user inputs.
• Set HttpOnly cookies to prevent JavaScript access.

npm install csurf

const csrf = require('csurf');
const cookieParser = require('cookie-parser');

app.use(cookieParser());
app.use(csrf({ cookie: true }));

// Add CSRF token to forms
app.get('/form', (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});

• Always use parameterized queries or ORMs never concatenate user input directly into queries.
• For SQL: use placeholders (?, $1) with drivers like mysql2 or pg.
• For MongoDB: Mongoose automatically sanitizes input, but still validate.
• Validate input types and lengths.

// BAD - vulnerable to SQL injection
const query = `SELECT * FROM users WHERE email = '${email}'`;

// GOOD - parameterized query
const [rows] = await pool.query('SELECT * FROM users WHERE email = ?', [email]);

• Always hash passwords with bcrypt (as covered in previous chapter).
• Use appropriate salt rounds (10-12 is good).
• Never store passwords in plain text.

// In production, use secure cookies
app.use(session({
  secret: 'secret',
  cookie: {
    secure: true, // Only send over HTTPS
    httpOnly: true, // Prevent JavaScript access
    sameSite: 'strict' // CSRF protection
  }
}));

npm install express-validator

const { body, validationResult } = require('express-validator');

app.post('/register',
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 6 }),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    // Process valid input
  }
);

// .env file
JWT_SECRET=your-super-secret-key
DB_PASSWORD=securepassword

// In code
const jwtSecret = process.env.JWT_SECRET;

• Use Helmet to set secure HTTP headers automatically.
• Prevent XSS by escaping output and using HttpOnly cookies.
• Prevent CSRF with csurf middleware and sameSite cookies.
• Always use parameterized queries to prevent injection.
• Validate and sanitize all user input.
• Use HTTPS in production with secure cookies.
• Store secrets in environment variables, never in code.
• Security is a process, not a one-time setup stay updated!