express-firegate

Lightweight security and request-filtering middleware for Express.js applications. It helps deflect suspicious, malicious, or abusive requests before they reach your route handlers.

Install

npm install express-firegate

Usage

const express = require('express')
const deflect = require('express-firegate')

const app = express()

app.use(deflect())

app.get('/', (req, res) => {
  res.json({ ok: true })
})

app.listen(3000)

Place deflect() early in the stack (before routes). If you want request bodies scanned, register body parsers first, then deflect({ scanBody: true }) (enabled by default when req.body exists).

app.use(express.json({ limit: '100kb' }))
app.use(deflect())

What it does

• Optional path traversal detection on the request URL
• Heuristic SQL injection and XSS checks on the URL, query string, selected headers, and (when present) JSON/form body
• Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy (only set if not already present)
• Max URL length guard
• Optional User-Agent blocklist (substring match, case-insensitive)
• allowLocalhost: when true (default), localhost clients skip checks so local development is not disrupted

Blocked requests receive statusCode (default 400) and JSON { "success": false, "error": "<message>" }.

Options

| Option | Type | Default | Description | | --- | --- | --- | --- | | enabled | boolean | true | Master switch | | statusCode | number | 400 | Status when blocking | | message | string | 'Suspicious request detected' | error field in JSON body | | sqlInjection | boolean | true | Enable SQLi heuristics | | xss | boolean | true | Enable XSS heuristics | | pathTraversal | boolean | true | Block .. style sequences in the URL | | securityHeaders | boolean | true | Apply baseline security headers | | maxUrlLength | number | 8192 | Maximum length of originalUrl | | blockUserAgents | string[] | [] | Block if user-agent contains any entry | | allowLocalhost | boolean | true | Skip checks for localhost | | scanBody | boolean | true | Scan req.body when defined | | onBlock | function | — | (req, reason) => void | | shouldBlock | function | — | (req, chunk) => boolean \| string \| void custom rule per scanned string |

Heuristics can have false positives on APIs that legitimately carry SQL-like or HTML-like text. Tune flags or use shouldBlock for stricter control.

License

MIT