This document details the security features implemented in our Basic RESTful API.

• Header-based: Uses X-API-Key header
• Configurable: API keys stored securely in environment variables
• Validation: Each request validated against stored keys
• Error Handling: Clear error messages for invalid/missing keys

// Example request
const response = await fetch('/api/health', {
  headers: {
    'X-API-Key': 'your-api-key'
  }
});

• Window: Rolling time window
• Limits: 100 requests per minute by default
• Headers: Standard rate limit headers included
  • RateLimit-Limit
  • RateLimit-Remaining
  • RateLimit-Reset

{
  windowMs: 60 * 1000, // 1 minute
  max: 100, // limit each IP to 100 requests per windowMs
  standardHeaders: true, // Return rate limit info in headers
  legacyHeaders: false // Disable the `X-RateLimit-*` headers
}

• HTML Stripping: Removes HTML tags
• Script Prevention: Blocks script injection
• Character Encoding: Proper encoding of special characters

// Input
{
  "name": "<script>alert('xss')</script>John<p>Test</p>",
  "email": "john@example.com"
}

// Output
{
  "name": "John",
  "email": "john@example.com"
}

• X-Frame-Options: Prevents clickjacking
• X-XSS-Protection: Browser XSS filtering
• X-Content-Type-Options: Prevents MIME-type sniffing
• Content-Security-Policy: Controls resource loading
• Strict-Transport-Security: Forces HTTPS

{
  frameguard: { action: 'deny' },
  xssFilter: true,
  noSniff: true,
  hsts: { maxAge: 31536000, includeSubDomains: true }
}

• Production Mode: Limited error details
• Development Mode: Detailed error information
• Status Codes: Appropriate HTTP status codes
• Validation Errors: Clear validation messages

{
  "error": "Validation Error",
  "message": "Invalid email format",
  "status": 400
}

• Email: Format validation
• Strings: Length and character checks
• Numbers: Range validation
• Custom: Domain-specific validation rules

// Email validation
function validateEmail(email) {
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return emailRegex.test(email);
}

• Authentication Tests: API key validation
• Rate Limit Tests: Request throttling
• XSS Tests: Input sanitization
• Validation Tests: Input validation
• Header Tests: Security headers

npm test

• npm audit: Dependency vulnerabilities
• Custom Checks: Application-specific security
• Headers Check: Security header validation
• Rate Limit Check: Throttling verification

npm run security-audit

1. Environment Variables

   • Use .env for configuration
   • Never commit sensitive data
   • Use secure defaults

2. API Keys

   • Regular rotation
   • Secure storage
   • Limited permissions

3. Rate Limiting

   • Prevent abuse
   • Fair resource usage
   • Clear feedback

4. Input Handling

   • Always validate
   • Always sanitize
   • Clear error messages

5. Error Handling

   • No sensitive data in errors
   • Appropriate status codes
   • Helpful messages

1. Dependencies

   • Regular updates
   • Security patches
   • Compatibility checks

2. Monitoring

   • Rate limit breaches
   • Authentication failures
   • Invalid requests

3. Logging

   • Security events
   • Access logs
   • Error logs

For security concerns or questions:

• Email: lovingthemoo@gmail.com
• GitHub: @lovingthemoo