Security Middleware

import express from "express";
import helmet from "helmet";
import cors from "cors";
import rateLimit from "express-rate-limit";
 
const app = express();
 
app.set("trust proxy", 1);
app.use(helmet());
app.use(cors({
  origin: process.env.ALLOWED_ORIGIN ?? "https://app.example.com",
  credentials: true,
}));
app.use(express.json({ limit: "1mb" }));
app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,
}));

import express from "express";
import helmet from "helmet";
import cors from "cors";
import rateLimit from "express-rate-limit";
 
const app = express();
 
app.set("trust proxy", 1);
 
app.use(helmet({
  contentSecurityPolicy: false, // enable if serving HTML from Express
  crossOriginResourcePolicy: { policy: "cross-origin" },
}));
 
const allowedOrigins = ["https://app.example.com", "https://staging.example.com"];
app.use(cors({
  origin(origin, callback) {
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error("Not allowed by CORS"));
    }
  },
  credentials: true,
}));
 
const apiLimiter = rateLimit({
  windowMs: 60_000,
  max: 60,
  standardHeaders: true,
  legacyHeaders: false,
});
 
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10,
  message: { error: "Too many login attempts" },
});
 
app.use(express.json({ limit: "1mb" }));
app.use("/api", apiLimiter);
app.post("/api/auth/login", authLimiter, loginHandler);
 
app.get("/health", (_req, res) => res.json({ ok: true }));
 
function loginHandler(_req: express.Request, res: express.Response) {
  res.json({ token: "..." });
}

import { RedisStore } from "rate-limit-redis";
import { createClient } from "redis";
 
const redis = createClient({ url: process.env.REDIS_URL });
await redis.connect();
 
const limiter = rateLimit({
  store: new RedisStore({ sendCommand: (...args) => redis.sendCommand(args) }),
  windowMs: 60_000,
  max: 100,
});