nestjs-security-validator

NestJS Security Validator

Enforces security defaults and defensive programming across NestJS applications.

1. Global Input Validation (ValidationPipe)

In main.ts, always configure ValidationPipe with stripping and rejection of unwhitelisted properties to prevent parameter injection:

// main.ts
import { ValidationPipe } from '@nestjs/common'

async function bootstrap() {
  const app = await NestFactory.create(AppModule)

  app.useGlobalPipes(
    new ValidationPipe({
      whitelist: true,               // Strips properties without decorators in DTO
      forbidNonWhitelisted: true,    // Throws error if unknown property is sent
      transform: true,               // Auto-transforms payloads to DTO instance types
      transformOptions: {
        enableImplicitConversion: false, // Explicit types only
      },
    }),
  )
}

---

2. Rate Limiting (@nestjs/throttler v5+)

Prevent brute-force and DoS attacks:

// app.module.ts
import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler'
import { APP_GUARD } from '@nestjs/core'

@Module({
  imports: [
    ThrottlerModule.forRoot([
      {
        name: 'short',
        ttl: 1000,
        limit: 10, // 10 requests per second
      },
      {
        name: 'medium',
        ttl: 60000,
        limit: 100, // 100 requests per minute
      },
    ]),
  ],
  providers: [
    {
      provide: APP_GUARD,
      useClass: ThrottlerGuard,
    },
  ],
})
export class AppModule {}

---

3. Helmet & CORS Protection

import helmet from 'helmet'

async function bootstrap() {
  const app = await NestFactory.create(AppModule)

  // Security HTTP headers
  app.use(helmet())

  // Explicit CORS
  app.enableCors({
    origin: process.env.ALLOWED_ORIGINS?.split(',') ?? ['http://localhost:3000'],
    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
    credentials: true,
  })
}

---

4. DTO Validation Decorators

Every field in DTOs must have explicit class-validator decorators: