API hardening under real load

Your API is public now. Within a week, you get scraped, brute-forced, and poked at by a vulnerability scanner. None of these attackers are targeted at you. They are background noise on the internet. Hardening is the set of habits that makes your service uninteresting to them.

The defenses every public API needs. Per-IP rate limiting to block brute force. CORS configured to only your own origin. helmet for security headers. Input validation at the edge with Zod. And structured logging with request ids so you can actually debug incidents when they happen.

server.ts

typescript

import helmet from 'helmet';
import rateLimit from 'express-rate-limit';
import cors from 'cors';

app.use(helmet());
app.use(cors({ origin: process.env.ALLOWED_ORIGIN }));
app.use(express.json({ limit: '1mb' }));
app.use(rateLimit({ windowMs: 60_000, limit: 100 }));

// Stricter limit on auth
app.use('/api/auth/login', rateLimit({ windowMs: 15 * 60_000, limit: 10 }));

Wire every defense into the Express app in the right order.

Quiz: Quiz

Loading practice…