Backend API Security — Comprehensive API Security Checklist

// API security checklist implementation
const securityMiddleware = [
  // 1. HTTPS enforcement
  (req, res, next) => {
    if (req.headers['x-forwarded-proto'] !== 'https' && process.env.NODE_ENV === 'production') {
      return res.status(301).redirect(`https://${req.headers.host}${req.url}`);
    }
    next();
  },

  // 2. Security headers
  helmet(),

  // 3. CORS configuration
  cors({
    origin: process.env.ALLOWED_ORIGINS?.split(',') || 'https://app.example.com',
    methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
    allowedHeaders: ['Content-Type', 'Authorization', 'X-CSRF-Token'],
    exposedHeaders: ['X-Request-Id'],
    credentials: true,
    maxAge: 86400
  }),

  // 4. Rate limiting
  rateLimit({ windowMs: 60000, max: 100 }),

  // 5. Body parsing with size limits
  express.json({ limit: '1mb' }),

  // 6. Request ID generation
  (req, res, next) => {
    req.id = req.headers['x-request-id'] || uuidv4();
    res.setHeader('X-Request-Id', req.id);
    next();
  }
];

app.use(securityMiddleware);

// API security monitoring
function logSecurityEvent(event, req, metadata = {}) {
  logger.warn({
    type: 'security',
    event,
    ip: req.ip,
    userId: req.user?.id,
    path: req.path,
    method: req.method,
    userAgent: req.headers['user-agent'],
    ...metadata
  });
}

// Security event handlers
app.use((err, req, res, next) => {
  if (err.name === 'UnauthorizedError') {
    logSecurityEvent('INVALID_TOKEN', req);
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
  if (err.code === 'LIMIT_FILE_SIZE') {
    logSecurityEvent('FILE_TOO_LARGE', req, { maxSize: '50MB' });
    return res.status(413).json({ error: 'File too large' });
  }
  next(err);
});