feat: add helmet, rate limiting and secure session configuration

Author: DineshSivalanka

backend/server.js

@@ -13,72 +13,117 @@ require('./config/passportConfig');
 
 const app = express();
 
-// CORS configuration (env-based whitelist)
-const rawAllowed = process.env.CLIENT_URL || process.env.ALLOWED_ORIGINS || 'http://localhost:5173';
-const allowedOrigins = rawAllowed.split(',').map(s => s.trim()).filter(Boolean);
-
-app.use(cors({
-    origin: function(origin, callback) {
-        // allow requests with no origin (server-to-server, curl)
-        if (!origin) return callback(null, true);
-        if (allowedOrigins.indexOf(origin) !== -1) return callback(null, true);
-        return callback(new Error('Not allowed by CORS'));
-    },
-    credentials: true,
-}));
+/* =========================
+   Security Middleware
+========================= */
 
+// Helmet security headers
 app.use(helmet());
 
-// Rate limiting
+// Rate Limiter
 const limiter = rateLimit({
-    windowMs: 15 * 60 * 1000, // 15 minutes
+    windowMs: 15 * 60 * 1000, // 15 mins
     max: 100,
     message: 'Too many requests from this IP, please try again later.',
     standardHeaders: true,
     legacyHeaders: false,
 });
+
 app.use('/api', limiter);
 
-// Middleware
+/* =========================
+   CORS Configuration
+========================= */
+
+const rawAllowedOrigins =
+    process.env.ALLOWED_ORIGINS ||
+    process.env.CLIENT_URL ||
+    'http://localhost:5173';
+
+const allowedOrigins = rawAllowedOrigins
+    .split(',')
+    .map(origin => origin.trim());
+
+app.use(cors({
+    origin: (origin, callback) => {
+        // Allow server-to-server requests
+        if (!origin) {
+            return callback(null, true);
+        }
+
+        if (allowedOrigins.includes(origin)) {
+            return callback(null, true);
+        }
+
+        return callback(new Error('Not allowed by CORS'));
+    },
+    credentials: true,
+}));
+
+/* =========================
+   Body Parser
+========================= */
+
 app.use(bodyParser.json());
-const sessionSecret = process.env.SESSION_SECRET || 'dev-secret';
-if (!process.env.SESSION_SECRET) {
-  console.warn('Warning: SESSION_SECRET is not set. Using a fallback development secret. Set SESSION_SECRET in backend/.env for production.');
+
+/* =========================
+   Session Configuration
+========================= */
+
+const sessionSecret = process.env.SESSION_SECRET;
+
+if (!sessionSecret) {
+    console.warn('⚠ SESSION_SECRET is missing in .env');
 }
+
 app.use(session({
-    secret: sessionSecret,
+    secret: sessionSecret || 'dev-secret',
     resave: false,
     saveUninitialized: false,
     cookie: {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',
-        maxAge: 1000 * 60 * 60 * 24 // 1 day
-    }
+        maxAge: 1000 * 60 * 60 * 24, // 1 day
+    },
 }));
+
+/* =========================
+   Passport Middleware
+========================= */
+
 app.use(passport.initialize());
 app.use(passport.session());
 
-// Routes
+/* =========================
+   Routes
+========================= */
+
 const authRoutes = require('./routes/auth');
+
 app.use('/api/auth', authRoutes);
 
-// Connect to MongoDB with sensible defaults and warnings
+/* =========================
+   MongoDB Connection
+========================= */
+
 const PORT = process.env.PORT || 5000;
-const MONGO_URI = process.env.MONGO_URI || 'mongodb://localhost:27017/githubTracker';
+const MONGO_URI =
+    process.env.MONGO_URI ||
+    'mongodb://127.0.0.1:27017/githubTracker';
 
 if (!process.env.MONGO_URI) {
-  console.warn('Warning: process.env.MONGO_URI is not set. Using local default:', MONGO_URI);
-}
-if (!process.env.SESSION_SECRET) {
-  console.warn('Warning: process.env.SESSION_SECRET is not set. Using an insecure default for development.');
+    console.warn('⚠ MONGO_URI missing in .env');
 }
 
-mongoose.connect(MONGO_URI, {}).then(() => {
-    console.log('Connected to MongoDB');
-    app.listen(PORT, () => {
-        console.log(`Server running on port ${PORT}`);
-    });
-}).catch((err) => {
-    console.log('MongoDB connection error:', err);
-});
+mongoose.connect(MONGO_URI)
+    .then(() => {
+        console.log('✅ Connected to MongoDB');
+
+        app.listen(PORT, () => {
+            console.log(`🚀 Server running on port ${PORT}`);
+        });
+    })
+    .catch((err) => {
+        console.error('❌ MongoDB connection error:', err);
+    });