Hardening Your API Before Launch: Security Checklist

1. Rate Limiting

Rate limiting prevents abuse and protects your API from DDoS attacks. Implement different limits for different endpoints—authentication endpoints should be stricter than read-only endpoints.

// Express rate limiting configuration
import rateLimit from 'express-rate-limit';

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 requests per window
  message: 'Too many login attempts',
  standardHeaders: true,
  legacyHeaders: false,
});

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100, // 100 requests per window
});

app.use('/api/auth', authLimiter);
app.use('/api', apiLimiter);

Use Redis for distributed rate limiting in production. This ensures limits are enforced across multiple server instances.

2. Input Validation

Never trust user input. Validate and sanitize all data before processing. Use libraries like Joi or Zod for schema validation. This prevents injection attacks and ensures data integrity.

// Zod validation example
import { z } from 'zod';

const createUserSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
  name: z.string().min(1).max(100),
});

app.post('/api/users', async (req, res) => {
  try {
    const validated = createUserSchema.parse(req.body);
    // Process validated data
  } catch (error) {
    return res.status(400).json({ error: 'Invalid input' });
  }
});

3. Security Headers

Security headers protect against common attacks like XSS, clickjacking, and MIME-type sniffing. Use Helmet.js to set appropriate headers automatically.

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true
  }
}));

4. Comprehensive Logging

Logging is essential for debugging and security monitoring. Log all authentication attempts, API errors, and suspicious activity. Use structured logging (JSON) for easy parsing.

Never log sensitive data like passwords, tokens, or credit card numbers. Mask PII in logs to comply with privacy regulations.

5. Error Handling

Proper error handling prevents information leakage. Never expose stack traces or internal error messages to clients. Return generic error messages while logging detailed errors server-side.