SECURITY/add security middlware

Author: ephcoding

package.json

@@ -3,7 +3,7 @@
 	"license": "ISC",
 	"name": "tornado-api",
 	"version": "0.1.0",
-	"description": "Storm Prediction stats for every tornado recorded since 1950.",
+	"description": "Stats for every recorded U.S. tornado since 1950.",
 	"main": "src/server.js",
 	"keywords": [
 		"api",
@@ -20,9 +20,14 @@
 		"csvtojson": "^2.0.10",
 		"dotenv": "^16.3.1",
 		"express": "^4.18.1",
+		"express-mongo-sanitize": "^2.2.0",
+		"express-rate-limit": "^6.9.0",
+		"helmet": "^7.0.0",
+		"hpp": "^0.2.3",
 		"mongodb": "^4.8.1",
 		"mongoose": "^7.3.0",
-		"morgan": "^1.10.0"
+		"morgan": "^1.10.0",
+		"xss-clean": "^0.1.4"
 	},
 	"devDependencies": {
 		"nodemon": "^2.0.16"

server.js

@@ -1,35 +1,43 @@
+const morgan = require("morgan");
+const xss = require("xss-clean");
+const express = require("express");
+const httpParamPollution = require("hpp");
+const helmetSecurityHeaders = require("helmet");
+const sanitize = require("express-mongo-sanitize");
+const expressRateLimit = require("express-rate-limit");
 require("dotenv").config({
 	path: "./config/config.env",
 });
-const express = require("express");
-const morgan = require("morgan");
+
 const { errorHandler } = require("./middleWare/error-handler");
-const connectDB = require("./config/database");
 
+const connectDB = require("./config/database");
 connectDB();
 
-const tornadoesRouter = require("./routes/tornadoes");
+const expressApp = express();
+expressApp.use(xss());
+expressApp.use(sanitize());
+expressApp.use(express.json());
+expressApp.use(expressRateLimit());
+expressApp.use(httpParamPollution());
+expressApp.use(helmetSecurityHeaders());
 
-const app = express();
-app.use(express.json());
+const tornadoesRouter = require("./routes/tornadoes");
 
 if ((process.env.NODE_ENV = "development")) {
-	app.use(morgan("dev"));
+	expressApp.use(morgan("dev"));
 }
 
-// TODO: add security & CORS here -- X
-
 const PORT = process.env.PORT || 5001;
-app.use("/v1/tornadoes", tornadoesRouter);
+expressApp.use("/v1/tornadoes", tornadoesRouter);
 
-app.listen(
+expressApp.listen(
 	PORT,
 	console.log(
 		`Server up in ${process.env.NODE_ENV} mode running on port ${PORT}`
 	)
 );
-
-app.use(errorHandler);
+expressApp.use(errorHandler);
 
 process.on("unhandledRejection", (error, promise) => {
 	console.log(`>> ERROR >>\n`, error.message);