@blixis-io/security

An optional production baseline for @blixis-io/http: CORS with explicit origins, security headers, rate limiting with a pluggable shared store, and a proxy-aware client address. Plain middleware; nothing is on by default.

npm install @blixis-io/security @blixis-io/http

import { createHttpApplication } from "@blixis-io/http";
import { cors, MemoryRateLimitStore, rateLimit, securityHeaders } from "@blixis-io/security";

const app = await createHttpApplication(AppModule, {
  middleware: [
    cors({ origins: ["https://app.example.com"], credentials: true }),
    securityHeaders(),
    rateLimit({ store: new MemoryRateLimitStore(), limit: 300, windowMs: 60_000 }),
  ],
});

cors first, so even a 429 carries its headers. credentials: true with "*" is refused when the middleware is created. The in-memory store is per process: behind several replicas use a shared store (a Postgres one is in the docs).

Part of Blixis Framework — full docs: Securing the API · API reference.