express-guardrail

Security middleware for Express.js applications.

express-guardrail helps protect your APIs and backend services from common attacks and unsafe requests with a simple middleware layer.

app.use(expressGuardrail());

Features

• SQL injection detection
• XSS protection
• Request sanitization
• Security headers
• Suspicious payload filtering
• Basic bot protection
• Request size limiting
• Lightweight and fast
• Express-compatible

📦 Installation

npm install express-guardrail

Quick Start

const express = require("express");
const expressGuardrail = require("express-guardrail");

const app = express();

app.use(express.json());

app.use(
  expressGuardrail({
    xss: true,
    sqlInjection: true,
    sanitize: true
  })
);

app.get("/", (req, res) => {
  res.json({ success: true });
});

app.listen(3000);

Protection Features

SQL Injection Detection

Detects suspicious patterns like:

SELECT * FROM users --
DROP TABLE accounts;

XSS Protection

Blocks payloads such as:

<script>alert("xss")</script>

Request Sanitization

Automatically sanitizes:

• request body
• query parameters
• headers

Security Headers

Adds common security headers to responses.

Configuration

app.use(
  expressGuardrail({
    xss: true,
    sqlInjection: true,
    sanitize: true,
    headers: true,
    requestLimit: "1mb",
    blockUserAgents: [],
    allowLocalhost: true
  })
);

Options

| Option | Type | Default | Description | | --- | --- | --- | --- | | xss | boolean | true | Enable XSS protection | | sqlInjection | boolean | true | Enable SQL injection detection | | sanitize | boolean | true | Sanitize request input | | headers | boolean | true | Add security headers | | requestLimit | string | "1mb" | Maximum request body size | | blockUserAgents | array | [] | Block specific user agents | | allowLocalhost | boolean | true | Allow localhost requests |

Blocked Request Response

{
  "success": false,
  "error": "Suspicious request detected"
}

Route Example

app.post("/api/login", expressGuardrail(), (req, res) => {
  res.json({ loggedIn: true });
});

Why express-guardrail?

Most Express applications combine multiple middleware packages for basic protection.

express-guardrail provides a single lightweight middleware focused on:

• request safety
• attack filtering
• API protection
• safer defaults

Roadmap

• [ ] Rate limiting
• [ ] CSRF protection
• [ ] AI-powered threat detection
• [ ] Redis-based IP reputation cache
• [ ] OWASP Top 10 presets
• [ ] Fastify support
• [ ] Bun runtime support

License

MIT

Contributing

Pull requests and issues are welcome.

Philosophy

Security middleware should be:

• simple
• composable
• fast
• developer-friendly

express-guardrail is designed to protect modern Express APIs with minimal setup.