How do helmet, CORS, and rate limiting work in Node.js?

Direct answer

helmet sets secure HTTP headers (CSP, HSTS, X-Frame-Options); CORS controls browser cross-origin access (Q47); rate limiting caps requests per IP/key — combine all three on public APIs, stricter limits on login and waitlist POST.

These are defense-in-depth layers — headers reduce browser attack surface, CORS scopes frontend origins, rate limits slow brute force and scraping.

Tool	Protects against
helmet	Clickjacking, MIME sniffing, missing HSTS
@fastify/cors	Unauthorized browser origins reading API
@fastify/rate-limit	Brute force, DoS, scraper abuse
Combined	Public /courses/waitlist + /auth/google callback

helmet in Fastify — @fastify/helmet plugin; tune CSP for Next.js inline needs.
Rate limit keys — IP for anonymous; userId for authenticated routes.
429 response — Retry-After header; log blocked IPs for abuse patterns.

security-middleware.mjs

await fastify.register(import("@fastify/helmet"));
await fastify.register(import("@fastify/cors"), {
  origin: ["https://acedevhub.com"],
  credentials: true,
});
await fastify.register(import("@fastify/rate-limit"), {
  max: 100,
  timeWindow: "1 minute",
});

fastify.post("/auth/login", {
  config: { rateLimit: { max: 5, timeWindow: "15 minutes" } },
}, loginHandler);