Why This Matters
We've run penetration tests on dozens of Node.js APIs. The same vulnerabilities appear again and again, not because developers don't care, but because nobody showed them the practical fixes. This is that guide.
A01: Broken Access Control
The #1 risk. Users accessing resources they shouldn't.
Always validate that the authenticated user is authorised to access the specific resource, not just authenticated. Check ownership: if a user requests data belonging to another user, return 403 Forbidden even if they're authenticated.
A02: Cryptographic Failures
Never store plain text passwords. Never use MD5 or SHA1 for passwords. Use bcrypt with a minimum of 12 salt rounds. Also enforce HTTPS, use httpOnly + secure cookies, and never log sensitive fields.
A03: Injection
SQL, NoSQL, and command injection are all still rampant. Always validate and sanitise inputs, use Zod or Joi for schema validation on every endpoint. For MongoDB, use express-mongo-sanitize to strip $ and . from request bodies.
A04: Insecure Design
No code fix here, this is a process issue. Before building any authenticated feature, ask: what happens if an attacker replays this request with a different user ID? What's the worst case if this endpoint is called 10,000 times per second? Can a regular user escalate to admin through any path?
A05: Security Misconfiguration
Use Helmet.js, it sets 11 security headers automatically in one line. Configure strict CORS with an explicit origin allowlist. Remove the X-Powered-By header.
A06: Vulnerable and Outdated Components
Run npm audit weekly. Use Snyk or GitHub Dependabot for automated alerts. Never skip security patch updates, even "minor" updates can contain critical security fixes.
A07: Identification and Authentication Failures
Rate limit authentication endpoints, 5 attempts per 15 minutes per IP is a reasonable starting point. Use short-lived JWTs (15 minutes) combined with a refresh token pattern. Never put sensitive data in JWT payloads, they're base64 encoded, not encrypted.
A08: Software and Data Integrity Failures
Use npm ci (not npm install) in CI to ensure package-lock.json is respected. For webhooks (Stripe, GitHub, etc.), always verify the request signature before processing the event. Never trust webhook data without signature verification.
A09: Security Logging and Monitoring Failures
If you're not logging security events, you won't know you've been breached. Log failed authentication attempts with IP, user ID, and timestamp. Use structured logging (Winston, Pino) and ship logs to a SIEM or Datadog. Set up alerts for unusual patterns, many failed logins, unusual geographic access, etc.
A10: Server-Side Request Forgery (SSRF)
If your API fetches URLs provided by users, validate the URL before fetching. Block requests to localhost, private IP ranges (192.168.x.x, 10.x.x.x, 172.16-31.x.x), and the AWS metadata endpoint (169.254.169.254). Only allow http: and https: protocols.
The Quick Checklist
- Helmet.js for security headers
- Rate limiting on auth endpoints
- Input validation with Zod or Joi on every endpoint
- bcrypt for passwords, never MD5, SHA1, or plain text
- MongoDB sanitisation with express-mongo-sanitize
- JWT with short expiry plus refresh token rotation
- CORS locked to specific origins
- npm audit in CI/CD pipeline
- Webhook signature verification
- Structured logging of security events
- No sensitive data in JWT payloads or logs
This checklist covers 80% of what we find in API penetration tests. Implement all of these and you'll be significantly more secure than the average Node.js API in production.