Fix Improper Assets Management in Express
Improper Assets Management (OWASP API9:2023) is a goldmine for attackers. In Express, this usually manifests as exposing sensitive files through poorly configured static middleware or leaving 'shadow' API versions active. If you don't inventory your endpoints and restrict file access, you're leaking source code, config files, and environment variables.
The Vulnerable Pattern
const express = require('express'); const app = express();// CRITICAL VULNERABILITY: Serving the current directory allows attackers // to download .env, package.json, and system source files. app.use(express.static(__dirname));
app.get(‘/api/v1/user’, (req, res) => { /* logic / }); // DEPRECATED: Leaving old versions active without monitoring app.get(‘/api/v0/user’, (req, res) => { / unpatched logic */ });
app.listen(3000);
The Secure Implementation
The exploit vector here is Information Disclosure and unpatched surface area. By serving `__dirname`, you expose the entire project structure; a simple GET /.env dumps your secrets. The fix involves three layers: 1. Isolation (moving assets to a dedicated, non-root subdirectory), 2. Strict Middleware Configuration (disabling dotfiles and indexing), and 3. Lifecycle Management (ensuring legacy endpoints are decommissioned with 410 Gone status). Stop leaking your infrastructure metadata and keep your API surface lean.
const express = require('express'); const path = require('path'); const app = express();const safePublicPath = path.join(__dirname, ‘dist/public’);
const staticOptions = { dotfiles: ‘ignore’, // Prevent access to .env, .git, etc. etag: true, index: false, // Disable directory indexing to prevent reconnaissance redirect: false, setHeaders: (res, path) => { res.set(‘X-Content-Type-Options’, ‘nosniff’); } };
// Secure: Scope to a dedicated assets folder and use strict options app.use(‘/static’, express.static(safePublicPath, staticOptions));
// Asset Lifecycle: Explicitly decommission old API versions app.use(‘/api/v0’, (req, res) => { res.status(410).json({ error: ‘API version deprecated’ }); });
app.listen(3000);
Your Express API
might be exposed to Improper Assets Management
74% of Express apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.