hardSystem Design

How do you secure your Node.js API endpoints?

Q: How do you secure your Node.js API endpoints?

**TL;DR.** Layer controls: **authenticate** (verify identity via JWT/session/OAuth), **authorize** (check permissions/RBAC per route), **validate input**, **rate-limit**, enforce **HTTPS** + security headers, and return **least-privilege** errors. Authentication answers *who*; authorization answers *what they may do*. authn who? authz allowed? <path class='d-edge-accent' d='M224 77 H248' marker-end='url(#j1)'/

383 views

Understand the problem

This question checks understanding of common security practices for web APIs built with Node.js.

securityapiauthenticationauthorization

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Auth + role guard + validation

const requireRole = (role) => (req, res, next) =>
  req.user?.roles?.includes(role) ? next() : res.status(403).end();

app.post('/admin/users',
  authenticate,                 // who? sets req.user
  requireRole('admin'),         // allowed?
  validate(CreateUserSchema),   // input ok?
  createUserHandler,
);

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What is the package.json "exports" field and conditional exports?

How do you build a worker-thread pool (e.g. Piscina) for CPU-bound work?