Posts tagged “Express”
What small Node teams should log in the AI-attack era
Bots are now more than half of web traffic, and 27% of attacks target APIs and identity systems. You don't need a security team to see it, just the right fields on every request. Here's the minimum to capture, five patterns to watch, and when to block.
Node.js large file upload handling without running out of memory
One 2 GB upload should not take your API down with it. Here is how to stream uploads in Express and Fastify, when to use presigned URLs, and which parsers to patch.
API key security for Node APIs: prefixes, hashing, scopes and rotation
A customer just pushed their API key to a public repo. Can you tell if anyone used it, and could a database leak expose every key? Design API key security in Node properly: prefixes, hashing, scopes and rotation.
Zod validation in Express and Fastify: request bodies, query strings and useful errors
A null where your handler expected an array becomes a 500 and a support ticket. Validate bodies, query strings and params with Zod 4 in Express 5 and Fastify 5, return 400s clients can act on, and stop extra fields at the door.
CORS misconfiguration in Express and Fastify: how to find it and test for it
One line added to silence a frontend error, cors({ origin: true, credentials: true }), lets any website read your users' data. Find CORS misconfiguration in Express and Fastify APIs, fix it, and test it in CI.
Idempotency keys in Node.js: safe retries for POST endpoints without double charges
A timeout, an automatic retry, and a customer charged twice. Idempotency keys make POST retries safe: here is a working Express and Postgres implementation, the status codes to return, and how long to keep keys.
Node.js log levels that mean something: a logging policy for small teams
At 3am your error log is full of scanner 404s and the real database timeout is buried. Here is a Node.js log levels policy a small team can paste into its repo, plus the code that enforces it.
BOLA vulnerability in Node APIs: how to fix IDOR and catch it in your logs
Change one digit in a URL and get another customer's invoice. Here is how to fix BOLA and IDOR structurally and spot someone probing for it before they find a gap.
Express 5 migration: what breaks in your API and how to fix it
You bump Express to 5 and the app dies with "Missing parameter name", or worse, starts fine and quietly breaks pagination. Here is what the Express 5 migration actually breaks in an API and how to fix each one.
Credential stuffing detection for Node APIs: spotting it in your login logs
Every request looks like a normal login, which is why stuffing goes unseen until a customer reports a login they did not make. Here is how to see it in your logs.
Node.js fetch timeout: deadlines with AbortSignal and undici
One slow vendor and every handler hangs, because Node fetch waits up to five minutes by default. Here is how to set deadlines with AbortSignal and undici in Express and Fastify.
Node.js rate limiting: fixed window vs sliding window vs token bucket
One client's runaway retry loop should not take your API down at 3am. Compare fixed window, sliding window and token bucket rate limiting in Node, with working code, a Redis version and what to ship this afternoon.