security-implementation-guide

Prevent SQL injection by always using parameterized queries instead of string concatenation. Pass user input as bound parameters, for example db.query('SELECT * FROM users WHERE email = $1', [email]), and configure your ORM to parameterize where clauses.

Hash passwords with bcrypt using a cost factor of 12 or higher, which generates a unique salt per password automatically. Verify credentials with bcrypt.compare rather than re-hashing, and never use MD5 or SHA1 for password storage.

Use the helmet middleware to set Content-Security-Policy, Strict-Transport-Security with a long max-age, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and a restrictive Referrer-Policy. Also disable the X-Powered-By header to avoid exposing server details.

Apply express-rate-limit to authentication routes, for example 5 attempts per 15-minute window, and combine it with account lockout after repeated failures. Log failed attempts with IP address and user agent for monitoring and alerting.

Validate URLs by allowlisting protocols, blocking internal hostnames, resolving DNS to reject private IP ranges, and enforcing timeouts and response size limits. Add network-level egress rules as defense in depth.

Use SameSite=Strict or Lax cookies as a baseline defense, and add token-based CSRF validation for state-changing requests where broader browser compatibility or cross-site flows are required. Sensitive operations should also require re-authentication.