Day 6: Securing Your API with HTTPS and Environment Variables

In this tutorial, you’ll learn how to secure your Express API by implementing HTTPS, managing sensitive configuration data using environment variables, and applying security best practices. By the end of today’s lesson, your API will be more secure and ready for deployment in production environments.

What You Will Learn Today:

1. Setting up HTTPS for secure communication
2. Using environment variables to manage sensitive data
3. Implementing security best practices in Express
4. Testing HTTPS with self-signed certificates

Step 1: Setting Up HTTPS

HTTPS (Hypertext Transfer Protocol Secure) encrypts the data sent between the client and the server, making it much harder for attackers to intercept or tamper with the data. To set up HTTPS for your Express API, you need SSL/TLS certificates.

Using Self-Signed Certificates for Development

For development purposes, you can generate self-signed SSL certificates. In production, you would obtain certificates from a trusted Certificate Authority (CA), such as Let’s Encrypt or AWS Certificate Manager.

1. Generate self-signed certificates using OpenSSL: Run the following command in your terminal to generate a self-signed certificate and private key:

   openssl req -nodes -new -x509 -keyout server.key -out server.cert

This will generate two files:

• server.key: The private key.
• server.cert: The self-signed certificate.

1. Configure HTTPS in Express: To use HTTPS in your Express app, modify your index.js to use the generated certificate and key. Open index.js and modify it as follows:

const express = require('express');
const https = require('https');
const fs = require('fs');
const mongoose = require('mongoose');
const app = express();
const PORT = process.env.PORT || 5000;

// Load SSL/TLS certificate and key
const privateKey = fs.readFileSync('server.key', 'utf8');
const certificate = fs.readFileSync('server.cert', 'utf8');
const credentials = { key: privateKey, cert: certificate };

// Middleware to parse JSON
app.use(express.json());

// Example route
app.get('/', (req, res) => {
  res.send('Welcome to the secure Express API with HTTPS!');
});

// Create HTTPS server
const httpsServer = https.createServer(credentials, app);

// Start the HTTPS server
httpsServer.listen(PORT, () => {
  console.log(`Secure server running on https://localhost:${PORT}`);
});

Explanation:

• https.createServer(): Creates an HTTPS server using the SSL certificate and private key.
• fs.readFileSync(): Reads the certificate and private key from the file system.
• The server listens on the specified port using HTTPS.

Testing HTTPS

1. Start the server:

node index.js

2. Open your browser or Postman and visit https://localhost:5000. Since the certificate is self-signed, your browser may warn you that the connection is not secure. For development, you can proceed by accepting the warning.

Step 2: Using Environment Variables

Environment variables allow you to store sensitive configuration data (e.g., database credentials, JWT secrets) outside your codebase, making your application more secure and easier to configure for different environments (development, production, etc.).

Installing dotenv

To manage environment variables, we’ll use the dotenv package.

1. Install dotenv:

npm install dotenv

2. Create a .env file in the root of your project directory. This file will store your environment variables.

touch .env

3. Add sensitive data to the .env file. For example:

# MongoDB connection string
MONGO_URI=mongodb+srv://<username>:<password>@cluster0.mongodb.net/myFirstDatabase?retryWrites=true&w=majority

# JWT Secret for authentication
JWT_SECRET=your_jwt_secret_key

# Application port
PORT=5000

4. Modify index.js to load environment variables using dotenv:

require('dotenv').config();
const express = require('express');
const https = require('https');
const fs = require('fs');
const mongoose = require('mongoose');
const app = express();
const PORT = process.env.PORT || 5000;

// MongoDB connection
mongoose.connect(process.env.MONGO_URI, { useNewUrlParser: true, useUnifiedTopology: true })
  .then(() => console.log('MongoDB connected'))
  .catch((err) => console.log('MongoDB connection error:', err));

// Load SSL/TLS certificate and key
const privateKey = fs.readFileSync('server.key', 'utf8');
const certificate = fs.readFileSync('server.cert', 'utf8');
const credentials = { key: privateKey, cert: certificate };

// Middleware
app.use(express.json());

// Example route
app.get('/', (req, res) => {
  res.send('Welcome to the secure Express API with HTTPS and environment variables!');
});

// Create HTTPS server
const httpsServer = https.createServer(credentials, app);

// Start the HTTPS server
httpsServer.listen(PORT, () => {
  console.log(`Secure server running on https://localhost:${PORT}`);
});

Explanation:

• require('dotenv').config(): Loads environment variables from the .env file into process.env.
• Environment Variables: We’ve replaced hard-coded values (e.g., MongoDB connection string, port) with environment variables for better security and flexibility.

Step 3: Implementing Security Best Practices

In addition to HTTPS and environment variables, there are several other security best practices to follow when building an Express API.

1. Helmet for Securing HTTP Headers

Helmet helps secure your app by setting various HTTP headers. This can protect against common vulnerabilities such as Cross-Site Scripting (XSS) and clickjacking.

1. Install Helmet:

npm install helmet

2. Add Helmet middleware in index.js:

const helmet = require('helmet');

// Middleware
app.use(helmet()); // Add Helmet for securing HTTP headers
app.use(express.json());

Explanation:

• Helmet: Automatically sets security-related HTTP headers, improving the security of your API.

2. Limiting Request Rate with Express Rate Limit

Rate limiting prevents abuse by limiting the number of requests a client can make in a given amount of time. This helps prevent denial-of-service (DoS) attacks.

1. Install express-rate-limit:

npm install express-rate-limit

2. Configure rate limiting middleware in index.js:

const rateLimit = require('express-rate-limit');

// Apply rate limiting to all requests
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per windowMs
  message: 'Too many requests, please try again later.',
});

app.use(limiter);

Explanation:

• Rate limiting: Limits the number of requests a user can make in a 15-minute window to 100. If exceeded, the server responds with a 429 Too Many Requests status.

3. Sanitizing User Input

Sanitizing input helps prevent attacks like SQL injection and cross-site scripting (XSS) by ensuring that user-provided data is clean.

1. Install express-validator (if not already installed):

npm install express-validator

2. Use sanitizers in the validation rules. For example, modify the user registration route in routes/users.js to sanitize input:

const { check, validationResult } = require('express-validator');

router.post(
  '/register',
  [
    check('name', 'Name is required').not().isEmpty().trim().escape(),
    check('email', 'Please include a valid email').isEmail().normalizeEmail(),
    check('password', 'Password must be at least 6 characters long').isLength({ min: 6 }).escape(),
  ],
  async (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    // Rest of the registration logic...
  }
);

Explanation:

• trim(): Removes whitespace from both ends of the input.
• escape(): Escapes special characters to prevent XSS attacks.
• normalizeEmail(): Sanitizes email input by converting it to a standard format.

Step 4: Testing HTTPS and Security Features

Now that we’ve implemented HTTPS, environment variables, and security best practices, let’s test the application.

1. Testing HTTPS

1. Run your server with:

node index.js

2. In Postman or your browser, access the API via https://localhost:5000. If you encounter a warning about the self-signed certificate, proceed to bypass the warning (for development purposes only).

2. Testing Rate Limiting

1. Make more than 100 requests to the API within 15 minutes.
2. You should receive the following response after exceeding the rate limit:

{
  "message": "Too many requests, please try again later."
}

3. Testing Input Sanitization

1. Try to send a registration request with malicious input such as <script>alert('XSS')</script> in the name field.
2. The sanitizer will escape this input and prevent any malicious code from being executed.

Step 5: Recap and Summary

In this tutorial, you learned how to secure your Express API using HTTPS, environment variables, and best practices such as helmet, rate limiting, and input sanitization. Here’s a quick summary of what you’ve done:

• Set up HTTPS using self-signed certificates for secure communication.
• Managed sensitive data using environment variables with the dotenv package.
• Added security-related HTTP headers using helmet.
• Limited the number of requests per client using rate limiting.
• Sanitized user input to prevent attacks like XSS and SQL injection.

By implementing these practices, your API is now more secure and ready for production environments.

Next Up: Day 7 – Securing User Authentication and Authorization

In Day 7, we’ll build on today’s security concepts and focus on securing user authentication and authorization in your API, including implementing role-based access control.

Stay tuned for more advanced features tomorrow!