Production security best practices

Do not use deprecated or vulnerable versions: Express 2.x and 3.x are no longer maintained and their security issues will not be fixed. Use TLS to secure connections and data; Nginx is recommended to handle TLS, and Let's Encrypt is a free, automated certificate authority. Validate user input — prevent open redirects by checking URLs before res.redirect or res.location, for example comparing new URL(req.query.url).host against an allowed host. Use Helmet, middleware that sets security-related HTTP response headers such as Content-Security-Policy and Strict-Transport-Security and removes X-Powered-By; each header can be configured or disabled. Reduce fingerprinting with app.disable('x-powered-by'), though a sophisticated attacker can still detect Express. Use cookies securely: avoid the default session cookie name, and set the secure (HTTPS only) and httpOnly (not accessible to client JavaScript) options. express-session stores session data on the server and saves only the session ID in the cookie; cookie-session serializes the entire session into the cookie, so reserve it for small data and do not exceed 4093 bytes per domain. Protect login endpoints against brute force by blocking on consecutive failed attempts per username and IP address and on failed attempts per IP over time; rate-limiter-flexible provides tools for this. Since npm@6, npm reviews installs automatically; analyze the dependency tree with npm audit and consider Snyk. Scope: Express. Reviewed October 4, 2026.