Backend Secure Configuration — Hardening Backend Application Configuration

// Environment hardening
const config = {
  production: {
    // Disable debug endpoints
    exposeErrorDetails: false,
    stackTraces: false,
    graphqlIntrospection: false,
    swaggerEnabled: false,

    // Secure defaults
    cookieSecure: true,
    trustProxy: true,
    corsOrigins: process.env.ALLOWED_ORIGINS?.split(',') || [],

    // Rate limiting
    rateLimiting: {
      enabled: true,
      maxRequests: 100,
      windowMs: 60000
    }
  },
  development: {
    exposeErrorDetails: true,
    stackTraces: true,
    swaggerEnabled: true,
    corsOrigins: ['*']
  }
};

// Error response security
class AppError extends Error {
  constructor(message, statusCode = 500, publicMessage = 'Internal server error') {
    super(message);
    this.statusCode = statusCode;
    this.publicMessage = publicMessage;
  }
}

function errorHandler(err, req, res, next) {
  const statusCode = err.statusCode || 500;

  // Log full error internally
  logger.error('Request failed', {
    error: err.message,
    stack: err.stack,
    path: req.path,
    correlationId: req.correlationId
  });

  // Return sanitized error to client
  res.status(statusCode).json({
    error: err.statusCode === 500 ? 'INTERNAL_ERROR' : err.name,
    message: config[process.env.NODE_ENV]?.exposeErrorDetails
      ? err.message
      : 'An unexpected error occurred',
    correlationId: req.correlationId
  });
}

// Disable server information disclosure
app.disable('x-powered-by');

// Framework security
// Helmet config for Express
app.use(helmet({
  hidePoweredBy: true,
  noCache: process.env.NODE_ENV === 'production'
}));

// Express trust proxy
app.set('trust proxy', 1);

// Cookie security
app.use(session({
  secret: process.env.SESSION_SECRET,
  name: '__Host-session',  // Prefix prevents subdomain cookie overwrite
  cookie: {
    secure: true,
    httpOnly: true,
    sameSite: 'strict',
    path: '/'
  }
}));