Securing NodeJS APIs

Understand cross origin resource sharing and misconfigurations that expose APIs to attacks. See how origin components—protocol, domain, and port—affect access and why access control allow origin star may invite requests.

Configure a CORS middleware for a Node.js API, test origins with Postman, and implement a whitelist to allow only localhost requests while logging origins and returning concise errors.

Learn to secure NodeJS APIs by building a regex-based origin white list, testing origins with the test method, and configuring environment-specific regex rules for ports in production middleware.

Explore http parameter pollution vulnerabilities in node apps and learn to mitigate them by using the npm hpp middleware, showing how last variable wins affects query parameters.

Explore cross site scripting, or xss, a type of injection where malicious scripts are injected into trusted websites. Learn the three common forms—reflected, dom-based, and stored xss.

Demonstrate cross site scripting (XSS) in a NodeJS API by testing a get route and observing script execution, then mitigate with the xss-clean middleware to sanitize input.

Explore how rate limiting manages the requests entering your API to prevent denial of service, latency spikes, and higher cloud costs from misconfigured or malicious clients.

Configure rate limiting in a node API using rate-limit-flexible with a memory store, enforcing one request per IP per second and returning 429 on excess requests.

Configure node.js sessions with express-session to create and manage cookies for user sessions, using secure and httpOnly flags, plus production versus development settings and max age.

Learn to build an authorization middleware in Node.js using JSON web tokens, verify tokens, and enforce scope checks (customer:create) to protect endpoints.