skills.rest
ArkhiMuttaqina
ArkhiMuttaqinaCOMMUNITY
Explore all skills by this author →
GitHub

hm-nodejs-security

Implement JWT authentication, CORS, rate limiting, and security headers for Fastify APIs.

Updated Apr 26, 2026
Search Tags:#security#authentication#rate limiting#jwt#owasp#cors#fastify
One-click install
npx skills add https://github.com/ArkhiMuttaqina/publisher-for-campuss --skill hm-nodejs-security-arkhimuttaqina
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hm-nodejs-security
Source: https://github.com/ArkhiMuttaqina/publisher-for-campuss/tree/main/skills/hm-nodejs-security
Command: npx skills add https://github.com/ArkhiMuttaqina/publisher-for-campuss --skill hm-nodejs-security-arkhimuttaqina

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Securing a Node.js Fastify API requires coordinating many layers—HTTP headers, CORS, rate limiting, JWT authentication, role-based authorization, input validation, and secret management—and missing any one of them leaves the application exposed to OWASP Top 10 vulnerabilities. ## Core Features & Use Cases - Layered Security Setup: Configure @fastify/helmet security headers, @fastify/cors origin policies, and @fastify/rate-limit with stricter limits on authentication endpoints. - JWT Authentication & Authorization: Implement short-lived access tokens, refresh token rotation with server-side revocation, and declarative role-based authorization preHandlers. - Input Validation & Secret Management: Validate request bodies and params with Zod, enforce body size limits, and validate environment secrets at startup with fail-fast behavior. - Use Case: When building a new Fastify API, apply this Skill to wire up helmet, CORS, rate limiting, and a complete JWT login/refresh flow with role-based route protection, then audit the result against the included OWASP Top 10 coverage matrix. ## Quick Start Ask the AI to set up JWT authentication with refresh token rotation, CORS, rate limiting, and helmet security headers for your Fastify API.

Frequently Asked Questions about hm-nodejs-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication in Fastify?▼

Register @fastify/jwt with a secret of at least 32 characters, set issuer and audience claims, and use short-lived access tokens around 15 minutes. Add an authenticate preHandler that calls request.jwtVerify() to protect routes.

How to add rate limiting to Fastify login endpoints?▼

Register @fastify/rate-limit globally, then override per-route using config.rateLimit on the login route. A strict limit such as 5 requests per 15 minutes on authentication endpoints mitigates brute-force attacks.

What is refresh token rotation and why use it?▼

Refresh token rotation invalidates the old refresh token and issues a new pair on every use, with tokens stored server-side in a database. This enables revocation and detects token theft, following RFC 8725 best practices.

Does @fastify/helmet protect against XSS and clickjacking?▼

Yes, @fastify/helmet sets headers including Content-Security-Policy for XSS protection and X-Frame-Options: SAMEORIGIN against clickjacking. Register it before any route plugins so headers apply to all responses.

Why should CORS origin not be * with credentials true?▼

Using a wildcard origin with credentials enabled allows any site to make authenticated cross-origin requests, exposing user data. In production, specify an explicit allowlist of origins from a validated environment variable.

How do I enforce role-based authorization in Fastify routes?▼

Create an authorize preHandler factory that checks request.user.role against allowed roles, and chain it after authenticate in the preHandler array. This keeps authorization declarative instead of scattering role checks inside handlers.

Related Skills

Explore More Software Engineering Skills→
NmBoydNmBoyd

backend-dev-guidelines

Standardize Node.js/Express/TypeScript backend architecture with layered patterns.

Community
Advanced
Motion-CreativeMotion-Creative
3

authenticate-apps

Add self-bootstrapping authentication to Fastify apps with scrypt-hashed credentials.

Official
Intermediate
florianbuetowflorianbuetow
12

logging

Analyze application code for security logging and monitoring failures mapped to OWASP Top 10 2021 A09.

Community
Advanced
andrey-belenandrey-belen

backend-passport-js

Authenticate Express applications using Passport.js strategies for JWT and OAuth.

Community
Intermediate