Hardening Nginx Reverse Proxies for Node.js Applications: Keep-Alive, HTTP/2 and Rate Limiting

Why Node.js Must Never Be Directly Exposed to the Internet

Exposing Node.js HTTP servers directly to public traffic leaves processes vulnerable to slowloris attacks, unbuffered large payload saturation, and SSL handshake overhead. Nginx acts as a high-performance reverse proxy buffer.

Optimized Upstream Configuration

upstream nodejs_cluster {
    server 127.0.0.1:3000 max_fails=3 fail_timeout=10s;
    server 127.0.0.1:3001 max_fails=3 fail_timeout=10s;
    keepalive 64;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    location / {
        proxy_pass http://nodejs_cluster;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}