Security

MasterController initializes a layered set of protections at startup. This page summarizes what’s active and how to configure each layer for production.

Secure headers & HSTS#

Sensible security headers are set automatically. Enable HSTS in production once you’re on HTTPS:

master.enableHSTS({ maxAge: 31536000, includeSubDomains: true, preload: true });

CSRF protection#

CSRF tokens are session-bound and single-use. Generate one for a form, and validate it on submit:

// in an action
const token = this.generateCSRFToken();
// later, on a mutating request
if (!this.validateCSRF()) return this.returnError(403, 'Invalid CSRF token');

Rate limiting#

Throttle abusive clients per action or globally:

if (!this.checkRateLimit()) return this.returnError(429, 'Too many requests');

Input validation & sanitization#

this.validateRequest({ email: 'required|email', age: 'integer' });
const clean = this.sanitizeInput(obj.params.formData.bio);
const safe = this.escapeHTML(userText);

Trusted proxies & client IP#

Behind a load balancer, declare your proxies so X-Forwarded-* headers are honored only from them (defends against IP/scheme spoofing):

master.trustedProxies = ['10.0.0.0/8'];

Prototype-pollution protection#

Dangerous keys (__proto__, constructor, prototype) are blocked from parsed input automatically, preventing a common class of object-injection attacks.

Request URL parsing#

Since 2.12.0 request targets are parsed without Node’s legacy url.parse(), which Node 24+ flags as a security risk (DEP0169). The router sees the path exactly as sent: .. segments are not resolved and //host/path stays a path, so /health/../admin matches no route rather than reaching /admin. Query strings parse into a null-prototype object, so a __proto__ key is just a key.

HTTPS redirect#

// Always pass allowed hosts to prevent open-redirect attacks
master.startHttpToHttpsRedirect(80, '0.0.0.0', [
  'yourdomain.com', 'www.yourdomain.com',
]);