Fix Shadow API Exposure in Express

Shadow APIs are the ghosts in your machine—undocumented, unmonitored endpoints like `/api/v1/internal/test` or legacy routes left rotting in production. They bypass your WAF rules and security audits because your team forgot they existed. To kill them, you need strict route management and environment-aware middleware.

The Vulnerable Pattern

const express = require('express');
const app = express();
// Production route
app.get(‘/api/v2/users’, (req, res) => {
res.json({ status: ‘success’ });
});
// SHADOW API: Legacy endpoint forgotten in codebase, exposing sensitive env vars
app.get(‘/api/v1/debug-internal-state’, (req, res) => {
res.json({ system_info: process.env, db_status: ‘connected’ });
});
app.listen(3000);

The Secure Implementation

Eliminating shadow APIs requires a three-pronged attack. First, decouple route definitions from the main app logic using Express Routers to ensure only explicitly defined paths are reachable. Second, use environment variables (NODE_ENV) to prevent debug or legacy routes from ever loading in a production context. Third, implement a global catch-all 404 handler to prevent information leakage from default Express behavior. For high-maturity setups, integrate OpenAPI/Swagger and use a 'Schema-First' approach where the code only executes if the path matches the documented specification, effectively nuking any undocumented 'shadow' paths.

const express = require('express');
const app = express();
const v2Router = express.Router();
// 1. Explicit Route Definition
v2Router.get(‘/users’, (req, res) => {
res.json({ status: ‘success’ });
});
// 2. Environment-Gated Routes (Only load debug routes in dev)
if (process.env.NODE_ENV === ‘development’) {
app.get(‘/api/debug’, (req, res) => {
res.json({ debug: true });
});
}
// 3. Strict Routing and Versioning
app.use(‘/api/v2’, v2Router);
// 4. Global Catch-all to prevent path traversal/discovery
app.use(’*’, (req, res) => {
res.status(404).json({ error: ‘Endpoint not found or deprecated’ });
});
app.listen(3000);