Security Checklist for Express.js Apps Built with AI

Express.js is the backbone of countless AI-generated backends and APIs. Its minimalist approach means AI tools must explicitly add every security layer — and they consistently skip the critical ones.

10-point security checklist

1. 1.

   Helmet middleware is installed and configured

   high

   helmet() sets essential security headers (CSP, HSTS, X-Frame-Options, etc.) in a single middleware. AI-generated Express apps almost never include it. Install helmet and add app.use(helmet()) before your routes. Customize CSP if your app loads external scripts.

2. 2.

   CORS is restricted to specific origins

   high

   AI tools set cors({ origin: '*' }) or cors() with no config. This allows any website to make authenticated requests to your API. Set origin to your specific frontend domain(s) and set credentials: true only if needed.

3. 3.

   Rate limiting is enabled

   high

   Use express-rate-limit on auth endpoints (login, signup, reset) and global endpoints. Without rate limiting, attackers can brute force credentials, scrape data, or DoS your service. AI tools never add rate limiting.

4. 4.

   Request body size is limited

   medium

   express.json() accepts up to 100KB by default, but AI tools sometimes increase this or add no limit. Large request bodies can crash your server or fill your disk. Set explicit limits: express.json({ limit: '10kb' }) for most endpoints.

5. 5.

   Input is validated before processing

   high

   AI-generated route handlers trust req.body, req.params, and req.query without validation. Use a validation library (Zod, Joi, express-validator) on every endpoint. Unvalidated input leads to injection attacks, type confusion, and crashes.

6. 6.

   SQL/NoSQL injection is prevented

   critical

   If using raw SQL queries (pg, mysql2), AI-generated code often concatenates user input into query strings. Always use parameterized queries. For MongoDB, watch for operator injection ($gt, $ne) in req.body used directly in queries.

7. 7.

   Auth middleware is applied to protected routes

   critical

   AI tools create auth middleware but sometimes forget to apply it to all protected routes. Review every route — especially ones added later in development. A single unprotected endpoint can be the entry point for a breach.

8. 8.

   Error handler doesn't leak stack traces

   medium

   Express's default error handler shows stack traces in development. AI tools often keep this behavior in production. Add a custom error handler that returns generic messages and logs the full error server-side.

9. 9.

   Session config is production-ready

   high

   Check express-session or cookie-session configuration: secret must be a strong random string (not "keyboard cat"), cookie must be secure in production, httpOnly must be true, sameSite must be "lax" or "strict".

10. 10.

    File uploads are restricted

    medium

    If using multer for file uploads, configure file size limits, allowed MIME types, and storage paths. AI-generated upload handlers often accept any file type and size. Use multer({ limits: { fileSize: 5 * 1024 * 1024 }, fileFilter: ... }).