security Best Practices

// Install security dependencies
npm install helmet express-rate-limit cors

const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const cors = require('cors');

// security middleware
app.use(helmet());

// Rate limiting
const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100, // limit each IP to 100 requests per windowMs
    message: 'Too many requests from this IP'
});
app.use('/api/', limiter);

// CORS configuration
const corsOptions = {
    origin: process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'],
    credentials: true,
    optionsSuccessStatus: 200
};
app.use(cors(corsOptions));

// Input validation middleware
const validateInput = (req, res, next) => {
    const { name, email, password } = req.body;
    
    // Sanitize inputs
    req.body.name = name?.trim().replace(/[<>]/g, '');
    req.body.email = email?.toLowerCase().trim();
    
    // Validate email
    const emailRegex = /^[^s@]+@[^s@]+.[^s@]+$/;
    if (!emailRegex.test(req.body.email)) {
        return res.status(400).json({ error: 'Invalid email format' });
    }
    
    // Validate password strength
    if (password && password.length < 8) {
        return res.status(400).json({ error: 'Password must be at least 8 characters long' });
    }
    
    next();
};

// Apply validation to routes
app.post('/register', validateInput, async (req, res) => {
    // Registration logic
});

// Environment variables
require('dotenv').config();

const config = {
    port: process.env.PORT || 3000,
    mongoUri: process.env.MONGO_URI,
    jwtSecret: process.env.JWT_SECRET,
    nodeEnv: process.env.NODE_ENV || 'development'
};

// Error handling for security
app.use((err, req, res, next) => {
    console.error(err.stack);
    
    // Don't leak error details in production
    if (process.env.NODE_ENV === 'production') {
        res.status(500).json({ error: 'Something went wrong!' });
    } else {
        res.status(500).json({ error: err.message });
    }
});