12. API Security Hardening: Helmet, CORS, Rate Limiting & OWASP Defenses • Node.js Backend Architecture: Libuv to High-Scale Microservices • Rishabh Ki Kaksha

Express.js default config me attacker ko `X-Powered-By: Express` header leak karta hai aur zero HTTP security headers bhejta hai.  
**Production Standard Hardening Pipeline:**

```typescript
import helmet from "helmet";
import cors from "cors";
import rateLimit from "express-rate-limit";
import { RedisStore } from "rate-limit-redis";

// 1. Helmet Security Headers
app.use(helmet());

// 2. Strict Origin CORS
app.use(cors({
    origin: ["https://rishabhkikaksha.boostengine.in"],
    methods: ["GET", "POST", "PUT", "DELETE"],
    credentials: true
}));

// 3. Distributed Redis Rate Limiting (100 reqs per 15 min per IP)
app.use(rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 100,
    standardHeaders: true,
    legacyHeaders: false,
    store: new RedisStore({ sendCommand: (...args: string[]) => redis.call(...args) }),
    message: { error: "Too many requests, please try again later." }
}));
```

---

### 2. OWASP Top 4 Defenses for Node.js:

1. **SQL / NoSQL Injection:** Parameterized queries (`$1, $2`) ya Mongoose Schema validation use karo; raw string concatenation (`$where: req.body`) strictly ban karo.
2. **Cross-Site Scripting (XSS):** Data output karte waqt sanitization + strict `Content-Security-Policy (CSP)` headers.
3. **Cross-Site Request Forgery (CSRF):** `SameSite=Strict` cookie attribute aur CSRF Tokens.
4. **Prototype Pollution:** `Object.create(null)` use karo ya `deep-merge` libraries ko strictly validate karo.

---

### 3. Master Comparison Matrix

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **CORS Preflight `OPTIONS` request kab trigger hoti hai?** -> Jab HTTP method `GET/HEAD/POST` ke alawa ho (jaise `PUT/DELETE`) ya request me custom headers (jaise `Authorization`, `Content-Type: application/json`) pass kiye jayein.
2. **Distributed microservice architecture me in-memory rate limiting kyu fail ho jaati hai?** -> Kyunki load balancer ke piche multiple Node.js instances chal rahe hote hain; centralized Redis rate limiter saare nodes ke request count ko aggregate karta hai.
3. **`helmet.contentSecurityPolicy()` kya karta hai?** -> Ye browser ko restrict karta hai ki scripts, styles aur images sirf trusted whitelisted CDNs aur domains se hi load ho sakein.

---
**Next Topic:** 13. Child Processes: spawn vs exec vs execFile vs fork

Loading lesson content...

JavaScript

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track