Building Secure Web Applications with JavaScript: Essential Best Practices

const express = require('express');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const { randomUUID } = require('node:crypto');

const app = express();
const PORT = Number(process.env.PORT) || 3000;

// Step 1: Configure HTTP security headers.
// Helmet sets headers that help mitigate several browser-side attacks.
app.use(helmet());
console.log('[1/7] Security headers configured.');

// Step 2: Parse JSON with a strict request-size limit.
// Small limits reduce unnecessary memory consumption from large payloads.
app.use(express.json({ limit: '10kb' }));
console.log('[2/7] JSON body parsing configured with a 10kb limit.');

// Step 3: Apply rate limiting to sensitive endpoints.
// Use a shared store instead of the default memory store when deploying
// multiple application instances behind a load balancer.
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 10,
  standardHeaders: 'draft-8',
  legacyHeaders: false,
  message: { error: 'Too many attempts. Please try again later.' }
});
console.log('[3/7] Authentication rate limiter configured.');

// Step 4: Define a reusable validation function.
// Treat every client-provided field as untrusted input.
function validateRegistration(body) {
  if (!body || typeof body !== 'object' || Array.isArray(body)) {
    return 'Request body must be a JSON object.';
  }

  const { email, password } = body;

  if (typeof email !== 'string' || email.length > 254) {
    return 'A valid email address is required.';
  }

  const normalizedEmail = email.trim().toLowerCase();
  const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

  if (!emailPattern.test(normalizedEmail)) {
    return 'A valid email address is required.';
  }

  if (typeof password !== 'string' || password.length < 12 || password.length > 128) {
    return 'Password must contain between 12 and 128 characters.';
  }

  return null;
}
console.log('[4/7] Registration input validation defined.');

// Step 5: Add a health endpoint that exposes no sensitive information.
app.get('/health', (req, res) => {
  res.status(200).json({ status: 'ok' });
});

// Step 6: Demonstrate a registration endpoint with safe response handling.
// This example intentionally does not persist users or implement login.
// Replace the placeholder with a database and Argon2id/bcrypt password hashing.
app.post('/register', loginLimiter, async (req, res, next) => {
  try {
    const validationError = validateRegistration(req.body);

    if (validationError) {
      return res.status(400).json({ error: validationError });
    }

    const email = req.body.email.trim().toLowerCase();

    // Never store or log the submitted password in plaintext.
    // In production, hash it with a vetted password-hashing library.
    // Enforce a database unique constraint on the normalized email field.
    const exampleUser = {
      id: randomUUID(),
      email,
      createdAt: new Date().toISOString()
    };

    console.log('[5/7] Registration request validated.');
    console.log('[6/7] Example user object created without a password.');

    // Return only explicitly selected, non-sensitive response fields.
    return res.status(201).json({
      message: 'Registration payload validated.',
      user: exampleUser
    });
  } catch (error) {
    // Pass unexpected errors to centralized middleware.
    return next(error);
  }
});

// Step 7: Handle unknown routes and errors without leaking internals.
app.use((req, res) => {
  res.status(404).json({ error: 'Resource not found.' });
});

app.use((error, req, res, next) => {
  // Do not log request bodies, passwords, cookies, or authorization headers.
  console.error('Request failed:', {
    requestId: req.get('x-request-id') || randomUUID(),
    method: req.method,
    path: req.path,
    errorName: error.name
  });

  if (res.headersSent) {
    return next(error);
  }

  if (error.type === 'entity.too.large') {
    return res.status(413).json({ error: 'Request payload is too large.' });
  }

  if (error instanceof SyntaxError && error.status === 400 && 'body' in error) {
    return res.status(400).json({ error: 'Malformed JSON request.' });
  }

  return res.status(500).json({ error: 'An unexpected error occurred.' });
});

// Bind to a configurable port; add TLS at the trusted proxy or server layer.
app.listen(PORT, () => {
  console.log(`[7/7] Server listening on http://localhost:${PORT}`);
  console.log('Try GET /health or POST /register with a JSON request body.');
});