Express API Security
Scan, harden, and automate security for Express.js APIs
npx middlebrick scan https://localhost:3000 --threshold 80 What Happens When Your Express API Gets Hit
Common Attacks Against Express APIs
Every row maps to an OWASP API Security Top 10 category. The CLI command runs the relevant checks against your endpoint.
| Attack | OWASP | Risk | CLI Command |
|---|---|---|---|
| NoSQL Injection | API8:2023 | critical | middlebrick scan <url> --threshold 90 |
| Authentication Bypass | API2:2023 | critical | middlebrick scan <url> --threshold 90 |
| BOLA / IDOR | API1:2023 | high | middlebrick scan <url> --threshold 80 |
| Rate Limiting Bypass | API4:2023 | high | middlebrick scan <url> --threshold 80 |
| SSRF via URL Parameters | API7:2023 | high | middlebrick scan <url> --threshold 80 |
| Mass Assignment | API3:2023 | medium | middlebrick scan <url> --threshold 70 |
| Excessive Data Exposure | API3:2023 | medium | middlebrick scan <url> --threshold 70 |
| JWT Misconfiguration | API2:2023 | high | middlebrick scan <url> --threshold 80 |
Express Defaults vs. middleBrick
Express ships with minimal security defaults. These scores reflect out-of-the-box configuration versus a scanned and hardened setup.
Install, Configure, Scan
# Install
npm install -g middlebrick
# Authenticate
middlebrick configure
# → Enter your API key from middlebrick.com/dashboard
# Scan an Express API
middlebrick scan https://localhost:3000
# Scan with a minimum score threshold (CI/CD gate)
middlebrick scan https://api.staging.example.com --threshold 80
# Get results as JSON
middlebrick scan https://api.example.com --format jsonGitHub Actions Workflow
Add this workflow to scan every pull request. The action fails the check if the score drops below your threshold.
name: API Security Scan
on: [pull_request]
permissions:
pull-requests: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: middlebrick/scan-action@v1
id: security
with:
api-key: ${{ secrets.MIDDLEBRICK_API_KEY }}
url: https://api.staging.example.com
threshold: 75
comment: true
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Enforce gate
if: always()
run: |
echo "Score: ${{ steps.security.outputs.score }}"
echo "Grade: ${{ steps.security.outputs.grade }}"
echo "Findings: ${{ steps.security.outputs.findings-count }}"Express / npm Ecosystem CVEs
Real vulnerabilities affecting Express and its core dependencies. middleBrick checks for patterns related to each of these.
body-parser denial of service via specially crafted Content-Type header. Affects all Express apps using the default JSON/URL-encoded parsers.
Open redirect in res.location() and res.redirect() allows attackers to redirect users to arbitrary URLs by manipulating the Location header.
Cross-site scripting (XSS) via response.redirect() when user-controlled input is passed without sanitization.
serve-static and send vulnerable to XSS via crafted file paths in directory listings when dotfiles are enabled.
cookie package (Express dependency) vulnerable to regular expression denial of service (ReDoS) via crafted cookie values.
Prototype poisoning in qs (Express query string parser) allows attackers to add/modify properties on Object.prototype via crafted query strings.
JavaScript Middleware vs. Rust Engine
Writing your own validation middleware is error-prone and slow. middleBrick handles it at the transport layer.
// Manual input validation middleware
app.use('/users', (req, res, next) => {
const body = JSON.stringify(req.body);
// Check for NoSQL operators
if (body.includes('$gt') || body.includes('$lt')
|| body.includes('$ne') || body.includes('$in')
|| body.includes('$regex') || body.includes('$where')) {
return res.status(400).json({
error: 'invalid_input'
});
}
// Still misses: $exists, $elemMatch,
// nested objects, encoded operators,
// prototype pollution vectors...
next();
});// middleBrick scans the full request surface:
// - JSON body (nested, recursive)
// - Query string parameters
// - URL path segments
// - All 47 known NoSQL operators
// - Encoded / obfuscated variants
// - Prototype pollution patterns
// - Zero-copy parsing, no GC pauses
//
// Result: blocked in 0.3ms avg
// No middleware code to write or maintain