How to Build and Secure a Production-Ready RESTful API with Node.js & Express

mkdir vyuhantrix-api && cd vyuhantrix-api
npm init -y
npm install express cors dotenv helmet
npm install -D nodemon

vyuhantrix-api/
├── src/
│   ├── routes/
│   │   └── guides.routes.js
│   ├── controllers/
│   │   └── guides.controller.js
│   ├── middleware/
│   │   └── errorHandler.js
│   └── app.js
├── .env
├── package.json
└── server.js

const express = require("express");
const cors = require("cors");
const helmet = require("helmet");
const guidesRouter = require("./routes/guides.routes");
const { errorHandler } = require("./middleware/errorHandler");

const app = express();

// 1. Security Middleware
app.use(helmet()); // Adds security HTTP response headers
app.use(cors({ origin: process.env.CLIENT_URL || "*" })); // CORS configuration

// 2. Body Parser Middleware
app.use(express.json({ limit: "10kb" })); // Defend against large payload DoS

// 3. Health Check Endpoint
app.get("/health", (req, res) => {
  res.status(200).json({ status: "healthy", timestamp: new Date().toISOString() });
});

// 4. API Routes
app.use("/api/v1/guides", guidesRouter);

// 5. Global 404 Handler
app.use((req, res) => {
  res.status(404).json({ success: false, error: "Endpoint not found" });
});

// 6. Centralized Error Handler
app.use(errorHandler);

module.exports = app;

// In-memory data store for demonstration
let guides = [
  { id: "1", title: "Next.js App Router Guide", category: "Web", isPublished: true },
  { id: "2", title: "PostgreSQL Indexing Mastery", category: "Database", isPublished: true },
];

// GET /api/v1/guides
exports.getGuides = async (req, res, next) => {
  try {
    const { category } = req.query;
    let results = guides;

    if (category) {
      results = results.filter(g => g.category.toLowerCase() === category.toLowerCase());
    }

    res.status(200).json({
      success: true,
      count: results.length,
      data: results,
    });
  } catch (error) {
    next(error);
  }
};

// GET /api/v1/guides/:id
exports.getGuideById = async (req, res, next) => {
  try {
    const guide = guides.find(g => g.id === req.params.id);
    if (!guide) {
      return res.status(404).json({ success: false, error: "Guide not found" });
    }
    res.status(200).json({ success: true, data: guide });
  } catch (error) {
    next(error);
  }
};

// POST /api/v1/guides
exports.createGuide = async (req, res, next) => {
  try {
    const { title, category } = req.body;

    if (!title || !category) {
      return res.status(400).json({
        success: false,
        error: "Both 'title' and 'category' are required fields",
      });
    }

    const newGuide = {
      id: String(Date.now()),
      title: title.trim(),
      category: category.trim(),
      isPublished: true,
    };

    guides.push(newGuide);
    res.status(201).json({ success: true, data: newGuide });
  } catch (error) {
    next(error);
  }
};

exports.errorHandler = (err, req, res, next) => {
  console.error("Unhandled API Error:", err.message);

  const statusCode = err.statusCode || 500;
  res.status(statusCode).json({
    success: false,
    error: process.env.NODE_ENV === "production" ? "Internal Server Error" : err.message,
  });
};