security-best-practices

Prevent SQL Injection by using parameterized queries instead of string concatenation, such as db.query('SELECT * FROM users WHERE email = ?', [email]). Combine this with Joi input validation to reject malformed input before it reaches the database.

Use the express-rate-limit middleware to cap requests per IP, for example 100 requests per 15 minutes on API routes. Apply stricter limits like 5 attempts per 15 minutes on authentication endpoints, with skipSuccessfulRequests enabled for login routes.

Helmet sets HTTP security headers including Content Security Policy, HSTS with preload, and frame protections. You can customize CSP directives for scripts, styles, images, and connections to allow only trusted sources.

The code examples target Express.js with middleware like helmet, csurf, and express-rate-limit. The underlying principles such as parameterized queries, output encoding, and token rotation apply to any web framework, but implementation details differ.

Refresh token rotation invalidates the old token every time a new access token is issued, limiting the damage if a token is stolen. Storing refresh tokens in the database allows server-side revocation and detection of token reuse.

Store secrets in environment variables loaded from .env files that are never committed to version control, or use Kubernetes Secrets for deployed workloads. Always validate that required variables like DATABASE_URL exist at startup and fail fast if missing.