Security & Rate Limiting

Concept#

Hardening HTTP Headers: Helmet#

By default, Express exposes HTTP headers (like X-Powered-By: Express) that leak technological details to attackers.

Helmet is a collection of middleware functions that set secure HTTP headers to prevent attacks like Cross-Site Scripting (XSS), Clickjacking, and MIME sniffing:

import express from 'express';
import helmet from 'helmet';
 
const app = express();
app.use(helmet()); // Sets secure headers, removes X-Powered-By

Some of Helmet's key features:

• Content-Security-Policy: Restricts where assets (scripts, images) can be loaded from.
• X-Frame-Options: Prevents Clickjacking by disallowing the page from loading inside iframes.
• Strict-Transport-Security (HSTS): Forces browsers to connect exclusively via HTTPS.

Rate Limiting: Preventing Brute-Force#

Without rate limits, attackers can launch brute-force scripts against login or search endpoints, exhausting server resources (DoS) or breaking passwords. Use express-rate-limit:

import rateLimit from 'express-rate-limit';