Best Practices

Security Best Practices

When building robust backend systems, security isn’t a afterthought—it’s the foundation that enables trust and resilience. In this section, we dive into three critical security practices that every backend engineer must master: Validation, Rate Limiting, and Encryption. Each practice addresses distinct vulnerabilities while working synergistically to protect your system. Let’s build confidence in your infrastructure, one practice at a time.

Validation

Validation ensures your application only processes legitimate data, preventing injection attacks, malformed requests, and data corruption. Skipping validation is like building a house without foundations—it might stand temporarily, but it’ll collapse under the first wave of abuse.

Why it matters: Unvalidated input can lead to SQL injection, cross-site scripting (XSS), data breaches, and service outages. Validation acts as your first line of defense against malicious payloads.

Key Principles

Input Sanitization: Remove or escape dangerous characters (e.g., &, <, >)
Schema Enforcement: Verify data conforms to expected formats (e.g., email addresses, numeric ranges)
Contextual Validation: Validate data at the point of use (not just at the database layer)
Error Handling: Return clear, non-technical errors without revealing sensitive information

Concrete Implementation Example

Here’s a runnable Express.js example using express-validator to validate user registration requests:

<code class="language-javascript">const express = require('express');
<p>const validate = require('express-validator');</p>

<p>const app = express();</p>

<p>app.use(express.json());</p>

<p>app.post('/register', [</p>
<p>  validate.body('email').isEmail().withMessage('Invalid email format'),</p>
<p>  validate.body('password').isLength({ min: 8 }).withMessage('Password too short'),</p>
<p>  validate.body('username').isAlphanumeric().withMessage('Username must be alphanumeric')</p>
<p>], (req, res) => {</p>
<p>  // Business logic here (e.g., user creation)</p>
<p>  res.status(201).json({ message: 'User created successfully' });</p>
<p>});</p>

<p>app.listen(3000, () => console.log('Server running on port 3000'));</code>

Why this works:

isEmail() ensures only valid email formats are accepted
isLength({ min: 8 }) enforces password strength
isAlphanumeric() prevents special characters in usernames
Errors are user-friendly and don’t expose internal implementation details

💡 Pro Tip: Always validate both request bodies and query parameters. A common oversight is allowing unvalidated ?id=123 in URLs, which can lead to path traversal attacks.

Rate Limiting

Rate limiting prevents abuse by restricting the number of requests a client can make within a specific timeframe. Without it, your system becomes vulnerable to denial-of-service (DoS) attacks, credential stuffing, and service exhaustion.

Why it matters: Unrestricted requests can overwhelm your database, kill your API, or expose sensitive data. Rate limiting is non-negotiable for production systems.

Key Principles

Per-Client Limits: Restrict requests based on client IP or token (not just global limits)
Time Windows: Define clear time windows (e.g., 1 minute, 1 hour)
Granular Controls: Allow different limits for different endpoints (e.g., free tier vs. premium users)
Exponential Backoff: Implement temporary throttling for repeated violations

Concrete Implementation Example

Here’s a practical rate-limiter implementation using express-rate-limit (a battle-tested middleware):

<code class="language-javascript">const rateLimit = require('express-rate-limit');

<p>// Apply to all API routes</p>
<p>const apiLimiter = rateLimit({</p>
<p>  windowMs: 15 <em> 60 </em> 1000, // 15 minutes</p>
<p>  max: 100, // 100 requests per window</p>
<p>  standardHeaders: true, // Enable X-RateLimit-* headers</p>
<p>  keyGenerator: (req) => req.ip, // Per-IP rate limiting</p>
<p>});</p>

<p>// Apply to specific endpoints (e.g., login)</p>
<p>const loginLimiter = rateLimit({</p>
<p>  windowMs: 60 * 1000, // 1 minute</p>
<p>  max: 5, // 5 login attempts per minute</p>
<p>  keyGenerator: (req) => req.headers.authorization, // Per-token rate limiting</p>
<p>});</p>

<p>const app = express();</p>

<p>app.use('/api', apiLimiter);</p>
<p>app.post('/login', loginLimiter, (req, res) => {</p>
<p>  // Authentication logic</p>
<p>  res.json({ token: 'fake-token' });</p>
<p>});</p>

<p>app.listen(3000, () => console.log('Rate limiting server running'));</code>

Why this works:

keyGenerator ensures limits are applied per client (IP or token)
standardHeaders helps clients understand their rate limits
Separate limits for critical endpoints (like login) prevent brute-force attacks
Exponential backoff is handled by the client (e.g., returning 429 Too Many Requests)

⚠️ Critical Note: Never use a single global rate limit. Attackers can bypass it by rotating IPs or tokens. Always combine IP-based and token-based limits for robust protection.

Encryption

Encryption transforms sensitive data into unreadable ciphertext, ensuring confidentiality even if intercepted. It’s the cornerstone of data protection in transit and at rest.

Why it matters: Without encryption, stolen data becomes immediately actionable. Encryption is non-negotiable for compliance (e.g., GDPR, HIPAA) and user trust.

Key Principles

In Transit: Use TLS 1.3+ for all HTTP communications
At Rest: Encrypt databases, files, and backups using strong algorithms
Key Management: Store keys separately from data (never hardcode)
Algorithm Selection: Prefer AES-256 over weaker algorithms (e.g., DES)

Concrete Implementation Example

Here’s how to encrypt data at rest using Node.js crypto module (with a real-world-safe key management approach):

<code class="language-javascript">const crypto = require('crypto');

<p>// Generate a random key (never hardcode in production!)</p>
<p>const key = crypto.randomBytes(32); // 256-bit AES key</p>

<p>// Encrypt a message</p>
<p>function encryptData(data) {</p>
<p>  const iv = crypto.randomBytes(16);</p>
<p>  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);</p>
<p>  const encrypted = Buffer.concat([</p>
<p>    cipher.update(data, 'utf8'),</p>
<p>    cipher.final()</p>
<p>  ]);</p>
<p>  return {</p>
<p>    iv: iv.toString('hex'),</p>
<p>    ciphertext: encrypted.toString('hex')</p>
<p>  };</p>
<p>}</p>

<p>// Decrypt data (with key and IV)</p>
<p>function decryptData(encryptedData) {</p>
<p>  const iv = Buffer.from(encryptedData.iv, 'hex');</p>
<p>  const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);</p>
<p>  const decrypted = Buffer.concat([</p>
<p>    decipher.update(encryptedData.ciphertext, 'hex'),</p>
<p>    decipher.final()</p>
<p>  ]);</p>
<p>  return decrypted.toString('utf8');</p>
<p>}</p>

<p>// Usage example</p>
<p>const encrypted = encryptData('Sensitive user data');</p>
<p>console.log(<code>Encrypted: ${encrypted.ciphertext}</code>);</code>

Why this works:

Uses AES-256 (industry standard for strong encryption)
Generates unique IVs for each encryption (prevents pattern recognition)
Critical: In production, store keys in a secure key management service (e.g., AWS KMS, HashiCorp Vault) — never in code or config files

🔒 Pro Tip: Always use TLS 1.3 for data in transit. Modern browsers and servers automatically handle this, but verify your server uses http2 with TLS 1.3 (e.g., nginx config: ssl_protocols TLSv1.2 TLSv1.3;).

Summary

In this chapter, we’ve covered three pillars of secure backend engineering: Validation (ensuring inputs are clean and safe), Rate Limiting (preventing abuse via request throttling), and Encryption (protecting data at rest and in transit). Together, these practices form a defense-in-depth strategy that:

Stops malicious inputs before they cause damage
Mitigates DoS attacks and credential stuffing
Guarantees confidentiality of sensitive data

Remember: Security is a continuous process, not a one-time check. Start with these practices, then layer additional controls like authentication, authorization, and monitoring. 🔒🛡️