Securing your Express web server

Deploying a web application to the internet also exposes your application to threats of hacking. Whether an attacker is attempting to access private user information, abusing your service, or otherwise exploiting a vulnerability for personal gain, it's important that you know how to protect yourself from the most common types of threats to minimize your application's risk.

Getting ready

The most important thing that you can do to help secure your Express web application for users is to encrypt content between your user's browser and your web server. Generating an SSL certificate to enable secure HTTPS communications between your Express web server and frontend application can be easy, but the nature generating and utilizing SSL certificates can be quite complicated.

For the sake of simplicity, we will generate a simple, unprotected, generic SSL certificate using openssl to help explain how to configure a SSL certificate in Express:

openssl req -x509 -newkey rsa...