CORS and Security

npm install cors

const cors = require('cors');

// Allow all origins (development only — never in production)
app.use(cors());

// Specific origin
app.use(cors({ origin: 'https://app.example.com' }));

// Multiple origins
const allowed = ['https://app.example.com', 'https://admin.example.com'];
app.use(cors({
  origin: (origin, callback) => {
    if (!origin || allowed.includes(origin)) return callback(null, true);
    callback(new Error('Not allowed by CORS'));
  },
}));

// Full options
app.use(cors({
  origin:           'https://app.example.com',
  methods:          ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
  allowedHeaders:   ['Content-Type', 'Authorization'],
  exposedHeaders:   ['X-Total-Count', 'X-Request-Id'],
  credentials:      true,          // allow cookies / auth headers
  maxAge:           86400,         // preflight cache (seconds)
  preflightContinue: false,        // pass OPTIONS to next handler if true
  optionsSuccessStatus: 204,       // some legacy browsers choke on 204
}));

// Server
app.use(cors({ origin: 'https://app.example.com', credentials: true }));

// Client (fetch)
fetch('https://api.example.com/data', { credentials: 'include' });

const corsAll     = cors();
const corsRestrict = cors({ origin: 'https://partner.com' });

app.get('/public',  corsAll,      handler);
app.get('/partner', corsRestrict, handler);

app.use((req, res, next) => {
  res.set('Access-Control-Allow-Origin',  'https://app.example.com');
  res.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.set('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.set('Access-Control-Allow-Credentials', 'true');

  if (req.method === 'OPTIONS') return res.sendStatus(204); // handle preflight
  next();
});

npm install helmet

const helmet = require('helmet');

// Sensible defaults — use this first, then customize
app.use(helmet());

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc:  ["'self'", 'https://cdn.example.com'],
      styleSrc:   ["'self'", "'unsafe-inline'"],
      imgSrc:     ["'self'", 'data:', 'https:'],
      connectSrc: ["'self'", 'https://api.example.com'],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
  frameguard: { action: 'deny' },       // block all framing
  referrerPolicy: { policy: 'same-origin' },
}));

// Disable a specific protection
app.use(helmet({ contentSecurityPolicy: false }));

app.use(helmet.contentSecurityPolicy({ directives: { /* ... */ } }));
app.use(helmet.hsts({ maxAge: 31536000 }));
app.use(helmet.noSniff());
app.use(helmet.frameguard({ action: 'sameorigin' }));
app.use(helmet.xssFilter());  // only sets X-XSS-Protection: 0 (disables the legacy filter)
app.use(helmet.hidePoweredBy());  // same as app.disable('x-powered-by')

npm install express-rate-limit

const rateLimit = require('express-rate-limit');

// Global limiter
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  limit:    100,             // requests per window per IP ('max' is the legacy pre-v7 alias)
  standardHeaders: true,     // Return rate limit info in `RateLimit-*` headers
  legacyHeaders:   false,    // Disable `X-RateLimit-*` headers
  message: { error: 'Too many requests, please try again later.' },
});
app.use('/api', limiter);

// Tighter limit for auth endpoints
const authLimiter = rateLimit({
  windowMs: 60 * 1000,  // 1 minute
  limit: 5,
  message: { error: 'Too many login attempts.' },
  skipSuccessfulRequests: true, // don't count 2xx responses
});
app.post('/api/auth/login', authLimiter, loginHandler);

app.disable('x-powered-by');
// Or with helmet:
app.use(helmet.hidePoweredBy());

npm install express-mongo-sanitize  # NoSQL injection (Express 4 only — see note)
npm install xss                     # XSS in string values

const mongoSanitize = require('express-mongo-sanitize');
const xss           = require('xss');

// Strip $ and . from keys (prevents NoSQL injection) — Express 4
app.use(mongoSanitize());

// Sanitize user strings before rendering
const safe = xss(req.body.comment);

npm install hpp

const hpp = require('hpp');
app.use(hpp()); // keeps last value of duplicate query params, whitelist options available