Summary - Security
- Node.js course
- Advanced
- Lesson 24/83
- 5 min
Combine helmet, cors, rate-limit and JWT to write a secure API.
Summary - Security
In this group you learned the core Express security tools: headers with helmet, cross-origin with cors, rate limiting with express-rate-limit, input validation with express-validator, and authentication with jsonwebtoken.
These five layers together form the basic security skeleton of an Express app. In production you also need HTTPS, expired-token handling, and logging. Security is not one tool but a layered approach.
Security checklist
Security checklist: (1) helmet() enabled on all routes. (2) CORS allows only trusted origins. (3) Rate limiting set on API routes. (4) All input validated. (5) JWTs short-lived and the secret strong.
Additionally: enforce HTTPS, keep error messages vague, update dependencies regularly. Run npm audit to scan for known vulnerabilities. Security is an ongoing process, not a one-time task.
Practice Verify JWT and log user
Import the jwt module. Produce a token: jwt.sign({ user: "Alex" }, "secret"). Then verify it with jwt.verify(token, "secret"). Log decoded.user.
Starter code
// import the module
// produce a token
// verify and log the userSample solution
const jwt = require("jsonwebtoken");
const token = jwt.sign({ user: "Alex" }, "secret");
const decoded = jwt.verify(token, "secret");
console.log(decoded.user);Expected output
Alex
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What are the core Express security tools?
- express, http, https, net, dns
- fs, path, url, os, events
- cluster, worker_threads, perf_hooks
- helmet, cors, rate-limit, validator, jwt Correct answer
Explanation: These five modules are the core of Express security.
2 Match each piece to its role
| Term | Meaning |
|---|---|
helmet |
Headers |
cors |
Cross-origin |
express-rate-limit |
Rate limiting |
jsonwebtoken |
Authentication |