SecureFlow Node.js SDK

The official Node.js Express SDK for integrating SecureFlow - Your Pluggable API Security & Threat Detection System.

Protect your APIs with automated Session Theft detection, Rate Limiting, Brute Force protection, and XSS filtering with a simple plug-and-play middleware.

Installation

npm install secureflow-node

Initialization

Import and initialize the SDK with your Project API Key.

const SecureFlow = require('secureflow-node');

const secureflow = new SecureFlow({
    apiKey: 'YOUR_SECUREFLOW_API_KEY' 
});

API Usage Reference

1. Protecting Routes (Express Middleware)

Protect any Express route by plugging in secureflow.validate(). The middleware automatically blocks requests if the attached Fingerprint triggers a Session-Theft mismatch, Rate Limit violation, or XSS attempt across your SecureFlow deployment.

Note: While making requests to API must pass x-session-id and x-fingerprint in headers (or in req.cookies.sessionId).

const express = require('express');
const app = express();

// Protect a sensitive route
app.get('/api/protected-data', secureflow.validate(), (req, res) => {
    res.json({ data: 'This is highly sensitive data!' });
});

2. Track Successful Logins (Session Binding)

When a user successfully authenticates on your app, report the event to SecureFlow so it can map the device fingerprint to the new session ID.

app.post('/api/login', async (req, res) => {
    const { email, password, fingerprint } = req.body;
    
    // ... Verify password/credentials internally ...
    const sessionId = "a_unique_session_id_generated_by_you";

    try {
        await secureflow.registerLogin(sessionId, fingerprint, email);
        res.json({ success: true, sessionId });
    } catch (error) {
        res.status(500).json({ error: 'Failed to complete login' });
    }
});

3. Track Failed Logins (Brute-Force & Bot Protection)

If a user fails to login, notify SecureFlow to count the failed attempts for that specific device fingerprint. If the threshold is breached, the fingerprint will be locked globally in your application.

app.post('/api/login', async (req, res) => {
    const { email, password, fingerprint } = req.body;
    const isValid = verifyPassword(email, password); // Your logic
    
    if (!isValid) {
        try {
            await secureflow.reportLoginFailure(fingerprint);
            return res.status(401).json({ error: 'Invalid credentials' });
        } catch (error) {
            // Handled locking (e.g. Rate Limit / 423 Locked)
            return res.status(error.response?.status || 500).json({ 
                error: error.response?.data?.message || 'Security lock active' 
            });
        }
    }
});

4. Tracking Logout (Session Unbinding)

Always notify SecureFlow when a user logs out. This invalidates the active sessionId tracking.

app.post('/api/logout', async (req, res) => {
    const sessionId = req.headers['x-session-id'];
    
    try {
      await secureflow.logout(sessionId);
      res.json({ success: true, message: 'Logged out' });
    } catch(err) {
      res.status(500).json({ success: false });
    }
});