api-security-hardening

# API Security Hardening Protect REST APIs against common vulnerabilities with multiple security layers. ## Security Middleware Stack (Express) ```javascript const helmet = require('helmet'); const rateLimit = require('express-rate-limit'); const mongoSanitize = require('express-mongo-sanitize'); app.use(helmet()); app.use(mongoSanitize()); // For input sanitization, see the `xss-prevention` skill — do NOT use the // deprecated `xss-clean` package (unmaintained since 2018; its own README // recommends migrating off it). app.use('/api/', rateLimit({ windowMs: 15 * 60 * 1000, max: 100 })); app.use('/api/auth/', rateLimit({ windowMs: 15 * 60 * 1000, max: 5 })); ``` ## Input Validation ```javascript const { body, validationResult } = require('express-validator'); const escapeHtml = require('escape-html'); app.post('/users', body('email').isEmail().normalizeEmail(), body('password').isLength({ min: 8 }).matches(/[A-Z]/).matches(/[0-9]/), // express-validator v7+ removed the built-in .escape() sanitizer; use a // customSanitizer backed by `escape-html` to HTML-escape the value. body('name').trim().isLength({ max: 100 }).customSanitizer(v => escapeHtml(v)), (req, res) => { const errors = validationResult(req); if (!errors.isEmpty()) { return res.status(400).json({ errors: errors.array() }); } // Process request } ); ``` ## Security Headers ```javascript app.use((req, res, next) => { res.setHeader('Content-Security-Policy', "de...