Node.js & Express Security Guide 2026: Helmet, Rate Limiting & Validation

npm install helmet

const express = require('express');
const helmet  = require('helmet');

const app = express();

// Apply all defaults (recommended starting point)
app.use(helmet());

// Or configure granularly
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc:  ["'self'"],
        scriptSrc:   ["'self'"],
        styleSrc:    ["'self'", 'https://fonts.googleapis.com'],
        fontSrc:     ["'self'", 'https://fonts.gstatic.com'],
        imgSrc:      ["'self'", 'data:', 'https:'],
        connectSrc:  ["'self'"],
        upgradeInsecureRequests: [],
      },
    },
    hsts: {
      maxAge:            31536000,
      includeSubDomains: true,
      preload:           true,
    },
    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
    frameguard:     { action: 'deny' },
  })
);

npm install express-rate-limit

const rateLimit = require('express-rate-limit');

// Global rate limiter
const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max:      100,             // requests per window
  standardHeaders: true,
  legacyHeaders:   false,
  message: { error: 'Too many requests, please try again later.' },
});

// Strict limiter for auth endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max:      10,
  skipSuccessfulRequests: true, // Only count failures
});

app.use(globalLimiter);
app.use('/api/auth', authLimiter);
app.use('/api/password-reset', authLimiter);

npm install rate-limit-redis ioredis

const RedisStore = require('rate-limit-redis');
const Redis      = require('ioredis');

const redis = new Redis(process.env.REDIS_URL);

const limiter = rateLimit({
  store: new RedisStore({ sendCommand: (...args) => redis.call(...args) }),
  windowMs: 15 * 60 * 1000,
  max: 100,
});

npm install cors

const cors = require('cors');

const allowedOrigins = [
  'https://yourdomain.com',
  'https://app.yourdomain.com',
  process.env.NODE_ENV === 'development' ? 'http://localhost:3000' : null,
].filter(Boolean);

app.use(
  cors({
    origin: (origin, callback) => {
      // Allow requests with no origin (mobile apps, curl)
      if (!origin) return callback(null, true);
      if (allowedOrigins.includes(origin)) return callback(null, true);
      callback(new Error('Not allowed by CORS policy'));
    },
    methods:          ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
    allowedHeaders:   ['Content-Type', 'Authorization'],
    credentials:      true,
    maxAge:           86400, // Cache preflight for 24 hours
  })
);

npm install zod

const { z }    = require('zod');
const express  = require('express');
const router   = express.Router();

const createUserSchema = z.object({
  name:     z.string().min(2).max(100),
  email:    z.string().email(),
  password: z.string().min(12).regex(
    /^(?=.*[A-Z])(?=.*[0-9])(?=.*[^A-Za-z0-9])/,
    'Password must contain uppercase, number, and special character'
  ),
  role:     z.enum(['user', 'editor']).optional().default('user'),
});

// Validation middleware factory
function validate(schema) {
  return (req, res, next) => {
    const result = schema.safeParse(req.body);
    if (!result.success) {
      return res.status(400).json({
        error:   'Validation failed',
        details: result.error.flatten().fieldErrors,
      });
    }
    req.body = result.data; // Replace with parsed/coerced data
    next();
  };
}

router.post('/users', validate(createUserSchema), async (req, res) => {
  const { name, email, password, role } = req.body;
  // All fields are validated and typed
});

npm install express-session connect-redis

const session      = require('express-session');
const RedisStore   = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient({ url: process.env.REDIS_URL });
redisClient.connect().catch(console.error);

app.use(
  session({
    store:  new RedisStore({ client: redisClient }),
    secret: process.env.SESSION_SECRET, // Long, random, from env
    resave:            false,
    saveUninitialized: false,
    name:   '__Host-session', // __Host- prefix enforces Secure + no Domain
    cookie: {
      secure:   true,      // HTTPS only
      httpOnly: true,      // No JS access
      sameSite: 'lax',
      maxAge:   30 * 60 * 1000, // 30 minutes
    },
  })
);

req.session.regenerate((err) => {
  if (err) return next(err);
  req.session.userId = user.id;
  res.json({ success: true });
});

npm audit
npm audit fix

npm audit --audit-level=high

npx snyk test