Node.js Security

import express from 'express';

function rateLimit({ windowMs, limit }) {
  const hits = new Map();
  return (req, res, next) => {
    const key = req.ip;
    const now = Date.now();
    const recent = (hits.get(key) ?? []).filter((t) => now - t < windowMs);
    recent.push(now);
    hits.set(key, recent);
    res.set('RateLimit-Remaining', String(Math.max(0, limit - recent.length)));
    if (recent.length > limit) {
      res.set('Retry-After', String(Math.ceil(windowMs / 1000)));
      return res.status(429).json({ error: 'Too many attempts, try again later' });
    }
    next();
  };
}

const app = express();
app.post('/login', rateLimit({ windowMs: 60_000, limit: 3 }), (req, res) => res.status(401).json({ error: 'Wrong password' }));

const server = app.listen(0, async () => {
  const url = `http://localhost:${server.address().port}/login`;
  for (let i = 1; i <= 5; i++) {
    const r = await fetch(url, { method: 'POST' });
    console.log(`Attempt ${i}: ${r.status} remaining=${r.headers.get('ratelimit-remaining')}`);
  }
  server.close();
});

import path from 'node:path';
import { mkdir, writeFile, readFile } from 'node:fs/promises';

const uploads = path.join(import.meta.dirname, 'uploads-demo');
await mkdir(uploads, { recursive: true });
await writeFile(path.join(uploads, 'invoice-17.pdf'), 'PDF data');
await writeFile(path.join(import.meta.dirname, 'secrets-demo.env'), 'API_KEY=abc123');

function unsafePath(name) {
  return path.join(uploads, name);
}

function safePath(name) {
  const full = path.resolve(uploads, name);
  if (!full.startsWith(uploads + path.sep)) throw new Error('Invalid file name');
  return full;
}

for (const name of ['invoice-17.pdf', '../secrets-demo.env']) {
  console.log(`unsafe ${name}: ${await readFile(unsafePath(name), 'utf8')}`);
  try {
    console.log(`safe ${name}: ${await readFile(safePath(name), 'utf8')}`);
  } catch (err) {
    console.log(`safe ${name}: ${err.message}`);
  }
}

import express from 'express';

const allowed = new Set(['https://shop.example', 'https://admin.shop.example']);

const app = express();
app.disable('x-powered-by');
app.use((req, res, next) => {
  res.set({
    'Content-Security-Policy': "default-src 'self'",
    'X-Content-Type-Options': 'nosniff',
    'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
    'Referrer-Policy': 'no-referrer',
  });
  const origin = req.get('Origin');
  if (origin && allowed.has(origin)) {
    res.set({ 'Access-Control-Allow-Origin': origin, Vary: 'Origin' });
  }
  next();
});
app.get('/api/me', (req, res) => res.json({ user: 'ada' }));

const server = app.listen(0, async () => {
  const url = `http://localhost:${server.address().port}/api/me`;
  for (const origin of ['https://shop.example', 'https://evil.example']) {
    const r = await fetch(url, { headers: { Origin: origin } });
    console.log(origin, '->', r.headers.get('access-control-allow-origin') ?? 'blocked by the browser');
  }
  const r = await fetch(url);
  console.log(r.headers.get('x-powered-by') ?? 'no X-Powered-By header');
  console.log(r.headers.get('content-security-policy'));
  server.close();
});