The Agent Skills Directory

[SAFE]: The authentication middleware uses JSON Web Tokens (JWT) verified against an environment variable (process.env.JWT_SECRET), following best practices for secret management.
[SAFE]: Input validation is implemented using the Zod library, providing a robust mechanism to sanitize and validate incoming request data across bodies, queries, and parameters.
[SAFE]: Rate limiting is configured using express-rate-limit with a Redis store, specifically including a stricter policy for authentication endpoints to mitigate brute-force attacks.
[SAFE]: The error handling middleware is designed to prevent sensitive information disclosure by checking the NODE_ENV and suppressing detailed error messages in production.
[SAFE]: CORS configuration uses an explicit allow-list for origins rather than wildcards, ensuring controlled access to the API.
[SAFE]: The skill recommends a correct middleware execution order, placing security headers (Helmet) and CORS before route handlers and data parsing.

middleware-patterns