Common Web Security Risks
Node.js APIs must defend against common web vulnerabilities including injection, broken access control, cross-site scripting, CSRF, insecure deserialization, credential leakage, and denial-of-service conditions.
Validate input at trust boundaries, use parameterized database operations, enforce authorization server-side, apply rate limits where appropriate, configure secure cookies, and use HTTPS in production.
Key Takeaways
- Treat every client input as untrusted.
- Authorization must be enforced on the server.
- Security headers, rate limiting, input validation, and secure secret handling are essential production practices.
Knowledge Check
Where should authorization checks ultimately be enforced?