Here's how I keep user data safe and stop the app from crashing.
- No LocalStorage: I use JSON Web Tokens (JWT) for authentication, but I never expose them to JavaScript. They get stored in
HttpOnlycookies. This means even if there's a Cross-Site Scripting (XSS) vulnerability somewhere, malicious scripts can't steal your login token. - Passwords: They are hashed using
bcryptwith a salt rounds factor of 12 before they ever hit the database.
- Helmet: I use the Helmet middleware to set a bunch of secure HTTP headers automatically (like stopping the site from being embedded in an iframe).
- Rate Limiting: I added a few layers of rate limiters.
- Login and signup routes have really strict limits so people can't brute-force passwords.
- The AI endpoints also have limits so someone can't spam the API and run up a huge Groq bill.
- CORS: The server is locked down to only accept requests from my specific frontend URLs.
- No Mongo Injection: I use
express-mongo-sanitize. It scrubs incoming requests and removes any keys that start with a$or have a.in them, which stops people from running raw queries against the database. - Zod Validation: Before a request even reaches the main logic, it runs through a Zod middleware. If the JSON payload doesn't perfectly match the shape I expect, the server just kicks it back with a 400 error.
- Scrubbing PII: When you tailor a resume, the backend grabs your profile data, but it purposefully strips out your Name, Email, Phone Number, and Social Links before sending anything to the AI. The LLM only ever sees your work history and skills.
- Catching Errors: There's a global error handler that catches async errors so a random bug won't crash the entire Node.js process.
- In production, it hides the messy stack traces and just sends a generic "Something went wrong" message to the user, so no one can see how the server is structured.