Lesson 09 · 10 min
Production: helmet, limits, logs
What to add to an API before opening it to the world.
10 minLesson 9 of 9Practice includedAsk AI on any point
Before going public, an API needs a few layers of protection. helmet sets security headers. express-rate-limit caps requests from one address and protects sign-in from brute force. A logger like pino-http writes each request as one JSON line with the method, path, status, and time. Behind a proxy (hosting, nginx) you need app.set("trust proxy", 1), otherwise the client's IP will be the proxy's IP.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.