Secure Node.js TypeScript

Overview

Write secure-by-default Node.js and TypeScript applications that neutralize common server-side threats. This skill provides security guidelines organized by domain, with inline patterns for the most critical controls.

All guidelines are mapped to OWASP Top 10:2025 categories for compliance tracking and audit purposes. See references/security-index.md for the complete OWASP mapping.

Security Tiers

Apply guidelines based on the code context:

Quick Patterns

The 10 most critical security controls. Apply these by default.

1. Enable Strict TypeScript

// tsconfig.json
{
  "compilerOptions": {
    "strict": true,
    "noImplicitAny": true,
    "strictNullChecks": true,
    "noUncheckedIndexedAccess": true
  }
}

2. Validate All Inputs with Zod

// DO: Schema validation at entry points
import { z } from 'zod'

const UserSchema = z.object({
  email: z.string().email(),
  age: z.number().int().min(0).max(150),
})

// In route handler
const result = UserSchema.safeParse(req.body)
if (!result.success) {
  return res.status(400).json({ error: 'Invalid input' })
}
const user = result.data // Type-safe validated data

3. Use Parameterized Queries

// DON'T: String concatenation (SQL injection)
const query = `SELECT * FROM users WHERE id = ${userId}`

// DO: Parameterized queries
const result = await db.query('SELECT * FROM users WHERE id = $1', [userId])

4. Hash Passwords with Argon2

import argon2 from 'argon2'

// Hash password
const hash = await argon2.hash(password, { type: argon2.argon2id })

// Verify password
const valid = await argon2.verify(hash, password)

5. Set Security Headers with Helmet

import helmet from 'helmet'
import express from 'express'

const app = express()
app.use(helmet()) // Sets HSTS, CSP, X-Frame-Options, etc.
app.disable('x-powered-by')

6. Limit Request Body Size

// DO: Enforce strict body limits
app.use(express.json({ limit: '1kb' })) // Adjust based on expected payload

// DON'T: Unlimited body parsing (DoS risk)
app.use(express.json())

7. Sanitize File Paths

import path from 'node:path'

// DO: Resolve and validate paths
const ALLOWED_DIR = '/app/uploads'
const safePath = path.resolve(ALLOWED_DIR, userInput)

if (!safePath.startsWith(ALLOWED_DIR)) {
  throw new Error('Path traversal attempt blocked')
}

8. Never Expose Stack Traces

// DO: Generic error response to clients
app.use((err: Error, req: Request, res: Response, next: NextFunction) => {
  console.error(err) // Log full error internally
  res.status(500).json({ error: 'Internal server error' }) // Generic to client
})

// DON'T: Expose error details
res.status(500).json({ error: err.message, stack: err.stack })

9. Use Environment Variables for Secrets

// DO: Load secrets from environment
import 'dotenv/config'

const dbPassword = process.env.DB_PASSWORD
if (!dbPassword) throw new Error('DB_PASSWORD required')

// DON'T: Hardcoded secrets
const dbPassword = 'secret123' // Never do this

10. Import with node: Protocol

// DO: Explicit Node.js built-in imports (prevents typosquatting)
import { createServer } from 'node:http'
import { readFile } from 'node:fs/promises'
import path from 'node:path'

// DON'T: Implicit imports
import { createServer } from 'http' // Could resolve to malicious package

Reference Loading Guide

Load reference files based on the task at hand:

Audit Script

Validate a project's tsconfig.json for security-relevant settings:

python3 scripts/audit-tsconfig.py /path/to/project

The script checks for:

• strict: true enabled
• noImplicitAny enabled
• strictNullChecks enabled
• noUncheckedIndexedAccess enabled
• Other security-relevant compiler options

Assets

Template configurations available in assets/:

• tsconfig.secure.json - Strict TypeScript configuration template
• eslint-security.config.js - ESLint security plugin configuration

Copy and adapt these to your project as a starting point.

Resources

• Security index: references/security-index.md
• TypeScript safety: references/typescript-safety.md
• Input validation: references/input-validation.md
• Authentication: references/authentication.md
• HTTP security: references/http-security.md
• Runtime safety: references/runtime-safety.md
• Filesystem paths: references/filesystem-paths.md
• Dependencies: references/dependencies.md
• Error logging: references/error-logging.md
• Operational: references/operational.md