How do you secure a Node.js API?

Direct answer

What a strong answer covers

How it works

Every request body, query, and header is validated against a schema before business code sees it, with unknown fields stripped and sizes bounded so a large payload cannot exhaust memory. Authentication uses vetted libraries and short-lived tokens or HttpOnly cookies; authorisation is checked on every resource access. Database access uses parameterised queries or an ORM that does so. Rate limits and timeouts protect against abuse and slowloris-style attacks, security headers are set with helmet or equivalent, dependencies are audited and updated on a schedule, and secrets arrive from the environment or a vault rather than the repository.

Example

An API validates each route with a zod schema, rejects bodies over 1 MB at the parser, checks that the caller owns the project ID on every project route, uses pg with $1 placeholders, applies a per-token limiter in Redis, and runs npm audit plus a lockfile update bot weekly. A prototype pollution finding in a nested-merge dependency was caught by the audit before it reached production.

Common mistakes

• Trusting req.body fields directly in a database query or a file path.
• Storing JWTs in localStorage where any XSS can read them.
• Pinning an old dependency with a known vulnerability because upgrading is inconvenient.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.