security-patterns

Prevent SQL injection by using parameterized queries instead of string concatenation, passing user input as bound parameters to the database driver. Alternatively, use an ORM with input validation, such as parsing and type-checking IDs before querying.

Hash passwords with bcrypt using a salt rounds factor of 10 before storing them, never saving plaintext passwords. Verify credentials at login with bcrypt.compare against the stored hash.

Use the helmet middleware to set headers automatically, or manually configure X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Content-Security-Policy, Referrer-Policy, and Permissions-Policy. These mitigate clickjacking, MIME sniffing, and XSS risks.

JWTs sent in Authorization headers are not vulnerable to CSRF, but tokens stored in cookies are. For cookie-based sessions, use SameSite=strict cookies, CSRF tokens via csurf, and origin header validation.

Rate limiting blocks brute-force credential attacks by capping requests per IP, such as 5 login attempts per 15 minutes. Use express-rate-limit with a Redis store for distributed deployments and skip counting successful requests.