Security & Edge Middleware

ExisJS provides native, zero-dependency edge and request security middleware built directly into core.

1. Edge Security Middlewares

The following security middlewares are available from exisjs/middleware and can be registered globally in server.ts or scoped to route trees via boundary.ts:

helmet(options?): Sets 14+ secure HTTP headers (Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and CSP).
csrf(options): Enforces the Signed Double Submit Cookie pattern to protect state-changing requests (POST, PUT, DELETE) from CSRF attacks.
hpp(): Protects against HTTP Parameter Pollution attacks by ensuring array query parameters/form fields are safely handled.
dbSanitize(options?): Protects against NoSQL query operator injection ($where and other malicious keys) before reaching database layers.
timeout(ms): Automatically terminates requests that exceed the specified timeout limit, returning a 503 response.

src/http/server.ts

import { exis } from 'exisjs'import { helmet, csrf, timeout, hpp } from 'exisjs/middleware'
export default exis({  async onStart(app) {    app.use(helmet())    app.use(timeout(10000))    app.use(hpp())  }})

2. In-Memory Rate Limiting

The core rateLimit middleware provides high-performance in-memory and off-heap native rate limiting:

src/http/boundary.ts

import { defineBoundary } from 'exisjs/router'import { rateLimit } from 'exisjs/middleware'
export const config = defineBoundary({})
// Apply rate limiting chain step across the boundaryexport const limiter = rateLimit({  windowMs: 60 * 1000, // 1 minute  max: 100, // 100 requests per minute  message: 'Too many requests from this IP, please try again after a minute'})

DEFAULT

[!NOTE] The core rateLimit middleware runs using an in-memory native off-heap store. For distributed, multi-instance rate limiting backed by Redis, use @exisjs/cache.

3. Role-Based Access Control (RBAC) Metadata

ExisJS allows declarative permission metadata to be attached to routes:

Functional Paradigm

src/http/admin/route.ts

import { controller, route } from 'exisjs/router'
export default controller({  deleteItem: route.delete('/:id', {    permissions: ['admin'],    handle({ params }) {      return { success: true, deleted: params.id }    }  })})

Class-Based (OOP) Paradigm

src/http/admin/route.ts

import { Controller, Delete, Param, Permissions } from 'exisjs/decorators'
@Controller()export default class AdminController {  @Permissions('admin')  @Delete('/:id')  async deleteItem(@Param('id') id: string) {    return { success: true, deleted: id }  }}

Continue to Project Structure Edit this page on GitHub