Security Implementation in Node.js

From the Express.js cheat sheet · Authentication & Security · verified Jul 2026

Security Implementation

Authentication and security best practices

javascript

// JWT Authentication
const jwt = require('jsonwebtoken')

app.post('/login', async (req, res) => {
  // Verify credentials
  const token = jwt.sign(
    { userId: user.id },
    process.env.JWT_SECRET,
    { expiresIn: '1d' }
  )
  res.json({ token })
})

// Security middleware
const helmet = require('helmet')
const rateLimit = require('express-rate-limit')

app.use(helmet())
app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
}))

🔒 Always hash passwords with bcrypt

✅ Use HTTPS in production

⚠️ Implement rate limiting for all endpoints

📌 Express 5: req.query is read-only - middleware that mutates it (express-mongo-sanitize) fails

Back to the full Express.js cheat sheet