express

typescript
import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";

const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";

JWT access + refresh token rotation (conceptual)

security node jwt
by codesnips 3 tabs
typescript
import type { IncomingMessage, ServerResponse } from "http";

const MIN_BYTES = 1024;

const INCOMPRESSIBLE = /^(image|video|audio)\/|application\/(zip|gzip|x-brotli|pdf|octet-stream)/i;

Response compression (only when it helps)

performance http express
by codesnips 3 tabs
typescript
import pino, { Logger } from 'pino';
import { AsyncLocalStorage } from 'node:async_hooks';

export interface Store {
  requestId: string;
  logger: Logger;

Request ID + structured logging (Express + pino)

express logging observability
by codesnips 3 tabs
typescript
import { createHash } from "crypto";
import { readFileSync } from "fs";

export function sha256(query: string): string {
  return createHash("sha256").update(query, "utf8").digest("hex");
}

GraphQL persisted queries (hash allowlist)

graphql security performance
by codesnips 3 tabs
typescript
import express from 'express';
import cookieParser from 'cookie-parser';
import { issueCsrfToken, csrfProtection } from './csrf';
import { transfersRouter } from './routes/transfers';

const app = express();

CSRF protection with double-submit cookie

security express csrf
by codesnips 3 tabs
typescript
import { Registry, Histogram, Counter, collectDefaultMetrics } from 'prom-client';

export const register = new Registry();

collectDefaultMetrics({ register });

Prometheus metrics for request latency

observability node metrics
by codesnips 3 tabs
typescript
import express, { Express, NextFunction, Request, Response } from 'express';
import { userRoutes } from './userRoutes';

function authenticate(req: Request, res: Response, next: NextFunction) {
  const header = req.header('authorization');
  if (!header || !header.startsWith('Bearer ')) {

Testing Express routes with Supertest + Jest

testing express supertest
by codesnips 4 tabs
typescript
export interface PageInfo {
  hasNextPage: boolean;
  hasPreviousPage: boolean;
  startCursor: string | null;
  endCursor: string | null;
}

API pagination response contract (page info)

typescript pagination cursor
by codesnips 4 tabs
typescript
import { OpenAPIRegistry, extendZodWithOpenApi } from '@asteasolutions/zod-to-openapi';
import { z } from 'zod';

extendZodWithOpenApi(z);

export const registry = new OpenAPIRegistry();

OpenAPI generation for REST endpoints

typescript openapi zod
by codesnips 4 tabs
typescript
import crypto from 'crypto';
import helmet from 'helmet';
import type { Express, Request, Response, NextFunction } from 'express';

function cspNonce(req: Request, res: Response, next: NextFunction): void {
  res.locals.cspNonce = crypto.randomBytes(16).toString('base64');

Security headers with helmet (baseline hardening)

security express helmet
by codesnips 3 tabs
typescript
import crypto from 'crypto';

interface VerifyOptions {
  rawBody: Buffer;
  signatureHeader: string | undefined;
  secret: string;

Webhook signature verification (timing-safe compare)

security webhooks hmac
by codesnips 3 tabs
typescript
import { JSDOM } from 'jsdom';
import createDOMPurify, { DOMPurifyI } from 'dompurify';

const { window } = new JSDOM('');
const DOMPurify: DOMPurifyI = createDOMPurify(window as unknown as Window);

Sanitize user HTML safely (DOMPurify + JSDOM)

security html dompurify
by codesnips 2 tabs