Posts tagged “Security”
What small Node teams should log in the AI-attack era
Bots are now more than half of web traffic, and 27% of attacks target APIs and identity systems. You don't need a security team to see it, just the right fields on every request. Here's the minimum to capture, five patterns to watch, and when to block.
Node.js large file upload handling without running out of memory
One 2 GB upload should not take your API down with it. Here is how to stream uploads in Express and Fastify, when to use presigned URLs, and which parsers to patch.
SSRF in Node.js: the fetch() you didn't mean to make
A customer pastes a webhook URL pointing at your cloud metadata endpoint, and your API fetches it. Learn how SSRF in Node.js happens, why blocklists on URL strings fail, and a tested safeFetch() you can ship today.
API key security for Node APIs: prefixes, hashing, scopes and rotation
A customer just pushed their API key to a public repo. Can you tell if anyone used it, and could a database leak expose every key? Design API key security in Node properly: prefixes, hashing, scopes and rotation.
CORS misconfiguration in Express and Fastify: how to find it and test for it
One line added to silence a frontend error, cors({ origin: true, credentials: true }), lets any website read your users' data. Find CORS misconfiguration in Express and Fastify APIs, fix it, and test it in CI.
BOLA vulnerability in Node APIs: how to fix IDOR and catch it in your logs
Change one digit in a URL and get another customer's invoice. Here is how to fix BOLA and IDOR structurally and spot someone probing for it before they find a gap.
Credential stuffing detection for Node APIs: spotting it in your login logs
Every request looks like a normal login, which is why stuffing goes unseen until a customer reports a login they did not make. Here is how to see it in your logs.
Node.js rate limiting: fixed window vs sliding window vs token bucket
One client's runaway retry loop should not take your API down at 3am. Compare fixed window, sliding window and token bucket rate limiting in Node, with working code, a Redis version and what to ship this afternoon.
How to redact sensitive data in logs for Node.js APIs
Found a bearer token in your logs? Here's how to keep secrets and personal data out of Node API logs in an afternoon: Pino redaction, URL and error scrubbing, body allowlists and a test that catches leaks.