Network Security

CORS — Cross-Origin Resource Sharing

CORS is the browser’s way of asking: “Is this frontend allowed to call this API?”

When app.example.com makes a request to api.example.com, the browser sends a preflight request:

// Browser sends preflight (automatically):
// OPTIONS /api/users
// Origin: https://app.example.com
// Access-Control-Request-Method: POST
// Access-Control-Request-Headers: Content-Type, Authorization

// Server must respond with:
// Access-Control-Allow-Origin: https://app.example.com
// Access-Control-Allow-Methods: GET, POST, PUT, DELETE
// Access-Control-Allow-Headers: Content-Type, Authorization
// Access-Control-Max-Age: 86400

// Express middleware
import cors from "cors";

app.use(cors({
  origin: ["https://app.example.com", "https://staging.example.com"],
  methods: ["GET", "POST", "PUT", "DELETE"],
  allowedHeaders: ["Content-Type", "Authorization"],
  credentials: true, // allow cookies
  maxAge: 86400,      // cache preflight for 24h
}));

Security Headers

// Essential security headers for any web application
const securityHeaders = {
  // Prevent clickjacking (embedding your site in an iframe)
  "X-Frame-Options": "DENY",

  // Prevent MIME type sniffing
  "X-Content-Type-Options": "nosniff",

  // Force HTTPS for 1 year
  "Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",

  // Control what the browser can load
  "Content-Security-Policy": [
    "default-src 'self'",
    "script-src 'self' 'nonce-abc123'",
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.example.com",
    "frame-ancestors 'none'",
  ].join("; "),

  // Control what info is sent in Referer header
  "Referrer-Policy": "strict-origin-when-cross-origin",

  // Opt into browser security features
  "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
};

Content Security Policy (CSP)

CSP tells the browser exactly what resources your page is allowed to load. This prevents XSS attacks — even if an attacker injects a script tag, the browser won’t execute it.

// Without CSP: injected <script> runs freely
// With CSP: browser blocks scripts not in the whitelist

// Nonce-based CSP (recommended)
// Server generates a random nonce for each request
import crypto from "node:crypto";

function generateCSP(): { header: string; nonce: string } {
  const nonce = crypto.randomBytes(16).toString("base64");

  return {
    nonce,
    header: [
      "default-src 'self'",
      `script-src 'nonce-${nonce}' 'strict-dynamic'`,
      "style-src 'self' 'unsafe-inline'",
      "object-src 'none'",
      "base-uri 'self'",
    ].join("; "),
  };
}

// In your HTML template:
// <script nonce="<%= nonce %>">...</script>
// Scripts without the matching nonce are blocked

Man-in-the-Middle (MITM) Attacks

An attacker positions themselves between client and server, intercepting or modifying traffic.

Defenses:

• TLS everywhere — encrypted traffic can’t be read or modified
• HSTS — prevents SSL stripping (downgrading HTTPS to HTTP)
• Certificate pinning — mobile apps verify the exact certificate, not just the chain
• DNSSEC — prevents DNS spoofing that could redirect traffic

Rate Limiting at the Network Layer

// Simple token bucket rate limiter
class RateLimiter {
  private tokens: Map<string, { count: number; resetAt: number }> = new Map();

  constructor(
    private maxRequests: number,
    private windowMs: number
  ) {}

  isAllowed(clientIP: string): boolean {
    const now = Date.now();
    const bucket = this.tokens.get(clientIP);

    if (!bucket || bucket.resetAt < now) {
      this.tokens.set(clientIP, { count: 1, resetAt: now + this.windowMs });
      return true;
    }

    if (bucket.count >= this.maxRequests) {
      return false; // 429 Too Many Requests
    }

    bucket.count++;
    return true;
  }
}

// Usage: 100 requests per minute per IP
const limiter = new RateLimiter(100, 60_000);

Key Takeaways

1. CORS is a browser feature, not a server security measure — APIs are still callable from non-browser clients
2. Security headers are cheap insurance — add them to every response
3. CSP prevents XSS even when your code has injection vulnerabilities
4. TLS + HSTS together prevent MITM and SSL stripping
5. Rate limiting at the network layer is your first line of defense against abuse