What are key security practices for Node.js web applications?

Summary

Validate all input (schemas), use parameterized queries, set security headers (helmet), apply rate limiting, keep dependencies patched (npm audit, Dependabot), avoid eval/child_process.exec with user input, protect against prototype pollution, store secrets in env/secret managers, and run as a non-root user.

Longer Answer

Also: limit request body sizes, use HTTPS, configure CORS narrowly, hash passwords with bcrypt/argon2, set secure cookie flags, and avoid exposing stack traces. Node's permission model (--permission) can restrict file system and child process access.

Key Points

• Validate input, parameterize queries
• Helmet, CORS, rate limits
• Patch dependencies; audit
• No eval/exec with user input
• Least privilege runtime