When you start to focus on the performance and security of your backend alongside the other features, you know that you're growing and maturing as a developer. It goes without saying but having some sort of security measure against common attacks is essential, even if it's just a hobby project.

If you're new to security or want to quickly get started with some basic protection, these 5 NPM packages will help you get started in just a few minutes. The best part about these packages is that all you have to do is just install them and use them as middleware. It's that easy!

In a hurry or just need the list of packages? Here are the 5 NPM packages that I'll be going over:

Helmet

What it does: Sets security-related HTTP response headers to protect against some well-known web vulnerabilities.

What does it protect against: Cross-site scripting attacks, cross-site injections, clickjacking, MIME sniffing and targeted attacks towards Express servers by disabling the X-Powered-By header.

How to use it:

npm install helmet

const app = require('express')();
const helmet = require('helmet');

// Using helmet middleware
app.use(helmet());

app.listen(1337);

import helmet from "helmet";

const app = express();

app.use(helmet());

XSS-Clean

What it does: Sanitizes user input coming from POST request body (req.body), GET request query (req.query) and URL parameters (req.params).

What does it protect against: Cross-site scripting / XSS attacks.

How to use it:

npm install xss-clean

const app = require('express')();
const xssClean = require('xss-clean');

// Protect against XSS attacks, should come before any routes
app.use(xssClean());

app.listen(1337);

npm install xss-clean --save

const restify = require('restify')
const xss = require('xss-clean')

const app = restify.createServer()

app.use(restify.bodyParser())

// make sure this comes before any routes
app.use(xss())

app.listen(8080)

HPP

What it does: Puts the array parameters in req.query and/or req.body asides and just selects the last parameter value to avoid HTTP Parameter Pollution attacks.

What does it protect against: Bypassing input validations and denial of service (DoS) attacks by uncaught TypeError in async code, leading to server crash.

How to use it:

npm install hpp

const app = require('express')();
const hpp = require('hpp');

// Protect against HPP, should come before any routes
app.use(hpp());

app.listen(1337);

npm install hpp --save

// ...
var hpp = require('hpp');
// ...
app.use(bodyParser.urlencoded()); // Make sure the body is parsed beforehand.

app.use(hpp()); // <- THIS IS THE NEW LINE

// Add your own middlewares afterwards, e.g.:
app.get('/search',

Express Mongo Sanitize

What it does: Searches for any keys in objects that begin with a $ sign or contain a . from req.body, req.query or req.params and either removes such keys and data or replaces the prohibited characters with another allowed character.

What does it protect against: MongoDB Operator Injection. Malicious users could send an object containing a $ operator, or including a ., which could change the context of a database operation.

How to use it:

npm install express-mongo-sanitize

const app = require('express')();
const mongoSanitize = require('express-mongo-sanitize');

// Remove all keys containing prohibited characters
app.use(mongoSanitize());

app.listen(1337);

Express Rate Limit

What does it do: Used to limit IP addresses from making repeated requests to API endpoints. An example would be to rate limit an endpoint that is responsible for sending password reset emails, which can incur additional fees.

What does it protect against: Brute force, denial of service (DoS) and distributed denial of service (DDoS) attacks.

How to use it:

npm install express-rate-limit

const app = require('express')();
const rateLimit = require('express-rate-limit');

// Restrict all routes to only 100 requests per IP address every 1o minutes
const limiter = rateLimit({
    windowMs: 10 * 60 * 1000,    // 10 minutes
    max: 100                     // 100 requests per IP
});
app.use(limiter);

app.listen(1337);

import { rateLimit } from 'express-rate-limit'

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
    standardHeaders: 'draft-7', // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
    legacyHeaders: false, // Disable the `X-RateLimit-*` headers.
    // store: ... , // Redis, Memcached, etc. See below.
})

// Apply the rate limiting middleware to all requests.
app.use(limiter)

With these 5 NPM packages, you can make your Node.js + Express.js application much more secure in just 5 minutes. All of the packages above are extremely easy to use, just export and use as a middleware.

What security precautions do you take? Or did I miss any of your favorite packages? Let me know in the discussion below and I'll be happy to hear your thoughts.