Security Hardening

# Using mod_ratelimit (bandwidth limiting)
<Location "/">
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 500  # 500 KB/s max
</Location>

# Using mod_evasive (request rate limiting)
<IfModule mod_evasive24.c>
    # Max requests per page per second
    DOSPageCount 10
    DOSPageInterval 1

    # Max requests per site per second
    DOSSiteCount 100
    DOSSiteInterval 1

    # Block period (seconds)
    DOSBlockingPeriod 10

    # Email notification
    DOSEmailNotify admin@example.com

    # Log directory
    DOSLogDir "/var/log/mod_evasive"
</IfModule>

# Using mod_qos (Quality of Service)
<IfModule mod_qos.c>
    # Max connections per IP
    QS_SrvMaxConnPerIP 50

    # Request rate limit
    QS_ClientEventRequestLimit 100
</IfModule>

const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');
const Redis = require('ioredis');

// Basic rate limiter (in-memory)
const generalLimiter = rateLimit({
    windowMs: 60 * 1000, // 1 minute
    max: 100,            // 100 requests per minute
    message: { error: 'Too many requests, slow down' },
    standardHeaders: true,  // Return rate limit info in headers
    legacyHeaders: false,
});

// Strict limiter for authentication
const authLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 5,                   // 5 attempts
    message: { error: 'Too many login attempts' },
    skipSuccessfulRequests: true, // Only count failures
});

// Production: Use Redis for distributed rate limiting
const redis = new Redis(process.env.REDIS_URL);
const distributedLimiter = rateLimit({
    windowMs: 60 * 1000,
    max: 100,
    store: new RedisStore({
        sendCommand: (...args) => redis.call(...args),
    }),
});

// Apply limiters
app.use(generalLimiter);
app.use('/login', authLimiter);
app.use('/api', distributedLimiter);

// Custom rate limit by API key
const apiKeyLimiter = rateLimit({
    windowMs: 60 * 1000,
    max: 1000,
    keyGenerator: (req) => req.headers['x-api-key'] || req.ip,
    skip: (req) => req.headers['x-api-key'] === 'premium-key',
});

# Global request body limit (in bytes)
LimitRequestBody 10485760  # 10MB

# Header limits
LimitRequestFields 100
LimitRequestFieldSize 8190
LimitRequestLine 8190

# Per-location override
<Location "/upload">
    LimitRequestBody 104857600  # 100MB
</Location>

<Location "/api">
    LimitRequestBody 1048576    # 1MB
</Location>

const express = require('express');
const app = express();

// JSON body limit
app.use(express.json({ limit: '1mb' }));

// URL-encoded form limit
app.use(express.urlencoded({ limit: '1mb', extended: true }));

// Raw body limit
app.use(express.raw({ limit: '10mb', type: 'application/octet-stream' }));

// File uploads with multer
const multer = require('multer');
const upload = multer({
    limits: {
        fileSize: 100 * 1024 * 1024, // 100MB
        files: 10,                    // Max 10 files
        fields: 50,                   // Max 50 form fields
    },
    fileFilter: (req, file, cb) => {
        // Only allow certain types
        const allowed = ['image/jpeg', 'image/png', 'application/pdf'];
        if (allowed.includes(file.mimetype)) {
            cb(null, true);
        } else {
            cb(new Error('Invalid file type'));
        }
    }
});

app.post('/upload', upload.array('files'), (req, res) => {
    res.json({ uploaded: req.files.length });
});

# General timeout (seconds)
Timeout 60

# Keep-alive settings
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5

# Request timeouts (mod_reqtimeout)
<IfModule mod_reqtimeout.c>
    # Header: 20 seconds initial, +10 per 500 bytes, max 40s
    RequestReadTimeout header=20-40,MinRate=500

    # Body: 20 seconds initial, +10 per 500 bytes
    RequestReadTimeout body=20,MinRate=500
</IfModule>

# Proxy timeouts
ProxyTimeout 60

# Per-location timeout (mod_proxy)
<Location "/api/export">
    ProxyTimeout 300
</Location>

const http = require('http');
const express = require('express');

const app = express();

// Create server with timeout
const server = http.createServer(app);
server.timeout = 120000;        // 2 minutes
server.keepAliveTimeout = 65000; // Must be > load balancer timeout
server.headersTimeout = 66000;   // Must be > keepAliveTimeout

// Per-request timeout middleware
const timeout = require('connect-timeout');

app.use(timeout('30s')); // 30 second default

// Longer timeout for specific routes
app.use('/api/export', timeout('5m'));

// Handle timeout
app.use((req, res, next) => {
    if (req.timedout) {
        return; // Response already sent
    }
    next();
});

// Abort long operations on timeout
app.get('/api/slow', async (req, res) => {
    const result = await doLongOperation({
        signal: req.socket.destroyed ? AbortSignal.abort() : undefined
    });
    res.json(result);
});

server.listen(3000);

<IfModule mod_headers.c>
    # Prevent clickjacking
    Header always set X-Frame-Options "SAMEORIGIN"

    # Prevent MIME sniffing
    Header always set X-Content-Type-Options "nosniff"

    # HSTS
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Referrer policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Content Security Policy
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"

    # Permissions Policy
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

const helmet = require('helmet');

// Helmet sets many security headers with sensible defaults
app.use(helmet());

// Customize specific headers
app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "'unsafe-inline'"],
            styleSrc: ["'self'", "'unsafe-inline'"],
            imgSrc: ["'self'", "data:", "https:"],
            connectSrc: ["'self'"],
            fontSrc: ["'self'"],
            frameAncestors: ["'self'"],
        },
    },
    hsts: {
        maxAge: 31536000,
        includeSubDomains: true,
        preload: true,
    },
    referrerPolicy: {
        policy: "strict-origin-when-cross-origin",
    },
}));

// Manual headers without helmet
app.use((req, res, next) => {
    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
    res.setHeader('X-Content-Type-Options', 'nosniff');
    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
    next();
});

# Hide Apache version
ServerTokens Prod
ServerSignature Off

# Hide PHP version (in php.ini)
# expose_php = Off

# Remove X-Powered-By
<IfModule mod_headers.c>
    Header unset X-Powered-By
    Header unset Server
</IfModule>

const express = require('express');
const app = express();

// Disable X-Powered-By header
app.disable('x-powered-by');

// Or remove it manually
app.use((req, res, next) => {
    res.removeHeader('X-Powered-By');
    next();
});

// Using helmet (does this automatically)
const helmet = require('helmet');
app.use(helmet.hidePoweredBy());