Why should you care?

Public APIs face bots, credential stuffing, and OWASP Top 10 attacks daily.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

app.use(helmet());
app.use(cors({ origin: [process.env.ANGULAR_APP!], credentials: true }));
app.use('/api', authRateLimit);
app.use('/api', authenticateJwt);
app.use('/api', validateContentType);

app.disable('x-powered-by');
app.set('trust proxy', 1); // correct client IP behind Nginx

What happened?

• helmet sets secure HTTP headers.
• cors whitelists Angular origin.
• Rate limit slows brute force.
• trust proxy ensures rate limit sees real IP.

Practice next

1. Terminate TLS at Nginx or cloud load balancer.
2. Require JWT on all mutating /api routes.
3. Validate Content-Type application/json.
4. Add request signing for partner B2B webhooks.
5. Enable mutual TLS for internal microservice calls.

Remember

Defense in depth on every layer. HTTPS non-negotiable in production. Security headers + auth + validation together.

Pen test remediation

Auditors flag missing security headers and open CORS.

Outcome: helmet + strict cors pass re-test; API certified.