Taksh's Dev Blogs

Defending Your Node.js App: Understanding and Mitigating DDoS Attacks

Patel Taksh — Thu, 25 Jun 2026 05:46:01 GMT

Welcome to Part 4, the final installment of our series on Defending Your Node.js App. In our previous article on CSRF, we learned how to protect users from forged requests. Today, we will zoom out from the application code and focus on understanding and mitigating DDoS (Distributed Denial of Service) attacks.

What is DDoS?

A DDoS (Distributed Denial of Service) attack is a cyberattack where attackers overwhelm a server, website, or API with an extremely large number of requests. The goal is to consume so much of the target's resources that it becomes slow, unavailable, or completely crashes.

Because too many fake requests are sent to a server simultaneously, real, legitimate users are blocked from accessing the application or website.

How It Works

During a DDoS attack, the basic flow is: Millions of fake requests ➔ Server Overload ➔ Crash / Slowdown

To generate this massive volume of traffic, attackers usually use:

Bot networks (Botnets)
Compromised computers
Malware-infected devices (IoT)
Automated scripts

The Impact

A successful DDoS attack can lead to severe consequences for a business:

Website downtime
Loss of revenue
Damage to reputation
Loss of customer trust

How to Prevent DDoS Attacks

Unlike XSS or NoSQL Injection, defending against massive DDoS attacks cannot be fully handled within the application code itself. However, there is one crucial first step you can implement in Node.js before relying on infrastructure.

Here are the key strategies to mitigate DDoS attacks:

1. Rate Limiting in Node.js

Limit the number of requests a single user or IP address can make within a specific time frame. This prevents automated scripts from flooding your server. You can implement this directly in your Express app using express-rate-limit.

npm install express-rate-limit

import express from 'express';
import rateLimit from 'express-rate-limit';

const app = express();

// Set up the global rate limiter
const globalLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes window
    max: 100, // Limit each IP to 100 requests per `windowMs`
    message: "Too many requests from this IP, please try again after 15 minutes." // Message sent back to the user
});

// Apply the rate limiter globally to all requests
app.use(globalLimiter);

// You can also apply stricter limits to specific routes (like login)
const loginLimiter = rateLimit({
    windowMs: 60 * 1000, // 1 minute window
    max: 5, // Limit each IP to 5 login attempts per minute
    message: "Too many login attempts, please try again after a minute."
});

app.post('/login', loginLimiter, (req, res) => {
    // Login logic here
    res.send("Login successful");
});

This is the one DDoS mitigation strategy you can implement directly in your Node.js app. Everything else happens at the infrastructure level.

2. Load Balancing

Distribute incoming traffic across multiple servers. This ensures that no single server is overwhelmed, improving overall resilience.

3. Firewall Rules (WAF)

Configure Web Application Firewalls (WAF) to inspect incoming traffic and block requests from known malicious IP addresses or unexpected geographic regions.

4. CDN & Caching

Content Delivery Networks (CDNs) absorb traffic at the edge (closer to the user) and serve cached content. This dramatically reduces the direct load on your origin server during an attack.

5. Intrusion Detection Systems (IDS)

Monitor network traffic for unusual patterns, sudden spikes, or anomalies that may indicate an impending DDoS attack.

6. Anti-DDoS Services

Use specialized services (like Cloudflare, AWS Shield, or Akamai) that provide infrastructure designed to detect and absorb massive DDoS attacks in real-time before they even reach your servers.

Conclusion

Using these strategies can help protect your website or application from DDoS attacks and ensure that legitimate users can access your services without interruption.

However, it is important to remember that no system is completely immune to DDoS attacks. Continuous monitoring, regular updates, and a proactive security approach are essential to minimize the risk and impact of such attacks.

Note: Load balancing, CDNs, and caching go beyond just Node.js and touch upon system architecture. We will discuss these topics in further detail in our upcoming System Design series!

Defending Your Node.js App: A Deep Dive into Cross-Site Request Forgery (CSRF) Prevention

Patel Taksh — Thu, 25 Jun 2026 05:43:42 GMT

Welcome to Part 3 of our series on Defending Your Node.js App. In our previous article on XSS, we explored how to stop attackers from injecting malicious scripts. Today, we will focus on understanding and preventing Cross-Site Request Forgery (CSRF) attacks in a Node.js environment.

What is CSRF?

CSRF (Cross-Site Request Forgery) is a type of attack where an attacker tricks a logged-in user into performing unwanted actions on a website without their knowledge.

For Node.js developers, understanding CSRF is critical because Express and other frameworks don't provide built-in CSRF protection by default, making applications vulnerable without proper implementation.

Common targets for CSRF attacks include:

Changing a password
Transferring money
Updating an email address
Deleting an account
Modifying profile information

A Real-Life Example

Imagine a user is already logged into a banking website, let's call it bank.com. Their browser already has an active login session (a cookie stored).

Now, an attacker creates a malicious website containing the following code:

If the browser automatically sends the bank's session cookie along with the request to the logged-in banking website, the bank will process the request as if it came from the legitimate user, transferring money to the attacker's account without the user's consent.

The CSRF Attack Architecture

Here is a step-by-step breakdown of how a CSRF attack happens:

The user logs into a website and receives a session cookie.
The session cookie is stored in the browser.
The user visits a malicious website while still logged into the original website.
The malicious website contains a hidden form that submits a request to the original website (e.g., transfer money, change password).
The browser automatically includes the session cookie in the request to the original website.
The server trusts the request because it appears to come from the authenticated user, and processes the action.
The action is performed without the user's knowledge or consent.

How to Prevent CSRF Attacks

Here are three effective strategies to protect your application from CSRF attacks:

Method 1: Use CSRF Tokens with `csrf-csrf`

The most robust way to prevent CSRF is by using Anti-CSRF tokens.

Generate a unique token for each user session.
Include the token in forms and AJAX requests.
Validate the token on the server side before processing the request.

First, install the recommended csrf-csrf package (since csurf is deprecated):

npm install csrf-csrf

Then, configure it in your Express app:

import express from 'express';
import { doubleCsrf } from 'csrf-csrf';
import cookieParser from 'cookie-parser';

const app = express();
app.use(cookieParser("super-secret"));
app.use(express.json());

const { doubleCsrfProtection, generateToken } = doubleCsrf({
  getSecret: () => "super-secret", // A secret to generate the token
  cookieName: "x-csrf-token", // Name of the cookie to store the secret
  cookieOptions: {
    sameSite: "lax", // Recommended sameSite policy
    secure: true,    // Send only over HTTPS
  },
  size: 64,
  ignoredMethods: ["GET", "HEAD", "OPTIONS"],
});

// Protect all routes
app.use(doubleCsrfProtection);

Provide the token to your frontend:

app.get("/csrf-token", (req, res) => {
    res.json({ 
        csrfToken: generateToken(req, res)
    });
});

On the frontend, include the CSRF token in your forms or AJAX requests:

fetch("/submit", {
    method: "POST",
    headers: {
        "Content-Type": "application/json",
        "x-csrf-token": csrfToken // Include the CSRF token in the request header
    },
});

The server will validate the token automatically. If it doesn't match or is missing, it will reject the request.

A Note on Single Page Applications (SPAs): If your frontend is a Single Page Application (SPA) that uses JSON Web Tokens (JWT) stored in memory and sent via the Authorization: Bearer header (instead of using cookies), your app is naturally CSRF-resistant. CSRF relies on the browser automatically attaching cookies to cross-origin requests. Since headers must be added manually in JavaScript, an attacker cannot force the victim's browser to send the JWT.

Method 2: Use Same-Site Cookies

Set the SameSite attribute of your cookies to Strict or Lax to prevent them from being sent with cross-site requests.

res.cookie("session_id", token_value, {
    sameSite: "Strict"
});

By doing this, the browser will not send the cookie along with requests initiated by third-party websites, thus preventing CSRF attacks.

Method 3: Use HttpOnly Cookies

Set the httpOnly attribute of cookies to prevent client-side scripts from accessing them.

res.cookie("session_id", token_value, {
    httpOnly: true
});

Important Distinction: Using httpOnly does not directly prevent CSRF attacks. Instead, it prevents XSS (Cross-Site Scripting) attacks from easily stealing your session cookie via document.cookie. However, because CSRF and XSS are often chained together, securing your cookies with httpOnly is a crucial part of your overall defense-in-depth strategy.

Summary

Preventing CSRF is a vital part of web application security. By implementing modern Anti-CSRF tokens with csrf-csrf, leveraging SameSite cookie attributes, and understanding how SPA architecture impacts your risk, you can ensure that your users' actions are truly their own.

Stay tuned! In Part 4 of our series, we will focus on DDoS (Distributed Denial of Service) attacks and how to mitigate them.

Defending Your Node.js App: A Deep Dive into Cross-Site Scripting (XSS) Prevention

Patel Taksh — Thu, 25 Jun 2026 05:42:22 GMT

Welcome to Part 2 of our series on Defending Your Node.js App. In Part 1, we covered how to secure your database against NoSQL Injection. Today, we will shift our focus to the frontend-backend boundary, exploring how to understand and prevent Cross-Site Scripting (XSS) attacks in a Node.js environment.

What is XSS?

XSS (Cross-Site Scripting) is a security vulnerability where an attacker injects malicious JavaScript code into a website, which then executes in another user's browser.

XSS is critical because JavaScript runs on both the server and client side, making proper input handling essential. If an attacker can execute code in a victim's browser, they can steal session cookies, hijack accounts, or deface the web page.

Types of XSS

There are two main types of XSS vulnerabilities you need to worry about:

Stored XSS: The malicious script is saved permanently in the database and affects all users who access the affected page. Common targets include comment sections, chat messages, and profile bios.

Example vulnerability:
```
// Saving an un-sanitized comment to the database
app.post('/comments', async (req, res) => {
    const { text } = req.body; 
    // If text is , it gets saved directly!
    await Comment.create({ text });
    res.send("Comment saved!");
});
```
When other users visit the comments page, the malicious script is loaded from the database and executed in their browser without their knowledge.
Reflected XSS: The malicious script comes through URL parameters or request data and executes immediately in the user's browser.

Example URL: https://example.com/search?q=

How the Attack Works: A Practical Example

Let's look at a vulnerable implementation. Imagine we have a simple search endpoint in an Express application that returns the search query back to the user.

The Vulnerable Search Endpoint

import express from "express";
const app = express();

// VULNERABILITY: Directly rendering user input into the HTML response
app.get('/search', (req, res) => {
    const query = req.query.q;
    res.send(`Search Results for: ${query}`);
});

Executing the XSS Attack

If a legitimate user searches for "node", they visit https://example.com/search?q=node, and the server responds with:

Search Results for: node

However, if an attacker crafts a malicious link and tricks a user into clicking it: https://example.com/search?q=

The server will respond with:

Search Results for:

The script will execute directly in the victim's browser, demonstrating a classic Reflected XSS attack.

How to Prevent XSS

Fortunately, preventing these attacks is straightforward. Here are the most effective methods to secure your application:

Method 1: Input Sanitization using `sanitize-html`

The first line of defense is ensuring the input is cleaned of any malicious scripts before it's saved to the database or rendered. We can use the robust sanitize-html package.

npm install sanitize-html

You can use it in your Express routes to clean specific fields:

import express from "express";
import sanitizeHtml from "sanitize-html";

const app = express();
app.use(express.json());

app.post('/comments', (req, res) => {
    const dirtyComment = req.body.text;
    
    // Sanitize the input to strip out any dangerous HTML tags or scripts
    const cleanComment = sanitizeHtml(dirtyComment, {
        allowedTags: [ 'b', 'i', 'em', 'strong', 'a' ],
        allowedAttributes: {
            'a': [ 'href' ]
        }
    });

    // Save cleanComment to the database...
    res.send({ success: true, comment: cleanComment });
});

This ensures that even if an attacker sends a