Securing, Testing and Deploying Node Apps

The to-do API reads, writes, persists and renders — now it must survive contact with the internet. The final chapter of the Node.js for Beginners series is the production checklist: secrets out of source code, automated tests with Node's built-in runner, a health endpoint, graceful shutdown, and the deployment steps that turn a laptop project into a running service.

Security, in priority order

Configuration belongs to the environment, never to the repository:

# .env — gitignored; commit .env.example with dummy values instead
PORT=3000
NODE_ENV=production
CORS_ORIGIN=https://app.example.com
API_TOKEN=replace-me-per-environment

const required = ['API_TOKEN', 'CORS_ORIGIN'];
for (const key of required) {
  if (!process.env[key]) {
    console.error(`Missing required environment variable: ${key}`);
    process.exit(1);            // fail fast at boot, not at first request
  }
}

Expected output: with a variable missing, the process refuses to start and prints the exact name of the problem — far kinder than a mysterious 401 an hour into production. Fail fast at boot, not slowly at runtime.

Tests with the built-in runner

Node ships a test runner and an assertion library — no packages required. Start the app on an ephemeral port (0 lets the OS pick a free one) and exercise it with the global fetch:

// test/api.test.js
import { test, before, after } from 'node:test';
import assert from 'node:assert/strict';
import { app } from '../src/app.js';

let server;
let base;

before(async () => {
  server = app.listen(0);
  base = `http://127.0.0.1:${server.address().port}`;
});
after(() => server.close());

test('GET /api/todos returns a list', async () => {
  const res = await fetch(`${base}/api/todos`);
  assert.equal(res.status, 200);
  const body = await res.json();
  assert.ok(Array.isArray(body.todos));
});

test('POST rejects a missing title', async () => {
  const res = await fetch(`${base}/api/todos`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({}),
  });
  assert.equal(res.status, 400);
});

node --test

Expected output:

TAP version 13
ok 1 - GET /api/todos returns a list
ok 2 - POST rejects a missing title
1..2
# tests 2
# pass 2
# fail 0

Add "test": "node --test" to your scripts so CI runs the same command you do. This is also why chapter 12 insisted on separating the app from app.listen: tests import the app and bind a random port without fighting over 3000.

Health checks and graceful shutdown

app.get('/healthz', (req, res) => {
  res.json({ status: 'ok', uptime: Math.round(process.uptime()) });
});

const server = app.listen(process.env.PORT ?? 3000, () => {
  console.log('listening');
});

function shutdown(signal) {
  console.log(`${signal} received — draining connections`);
  server.close(async () => {
    console.log('all connections finished');
    process.exit(0);
  });
  setTimeout(() => process.exit(1), 10_000).unref();  // hard deadline
}

process.on('SIGTERM', shutdown);
process.on('SIGINT', shutdown);

Expected output: curl localhost:3000/healthz answers {"status":"ok","uptime":42}; sending SIGTERM prints the drain message, lets in-flight requests finish, then exits 0 — while curl /api/todos run during shutdown still completes. Platforms probe healthz to route traffic and send SIGTERM to stop you; implementing both is table stakes.

Deploying

1. Build on the lock file — npm ci --omit=dev installs production dependencies exactly, no dev tools in the image.
2. Run behind a supervisor — the platform's process manager, or PM2 on a VPS, restarts crashes and keeps you in the boot order.
3. Terminate TLS at the edge — the platform or a reverse proxy handles HTTPS; your app speaks plain HTTP on an internal port.
4. Send logs to stdout/stderr — no log files to rotate; collectors grab the streams (chapter 3's split finally pays off).
5. Ship the data story — a persistent volume for data/todos.json, or move to a managed database before launch.
6. Watch the health endpoint — alert when healthz fails; deploy only when it passes afterwards.

npm ci --omit=dev
NODE_ENV=production node src/server.js
curl -fsS http://localhost:3000/healthz

Expected output: {"status":"ok","uptime":0} — the service is up, answering, and ready to receive traffic from the proxy. Hosts such as Render, Railway, Fly.io or a plain VPS with Docker all follow this same recipe; only the manifest changes.

Common mistakes

• Secrets committed to Git — history keeps them forever; rotate the value and move it to environment variables.
• Testing only by hand — the moment validation changes, nothing notices until a user does.
• Ignoring shutdown signals — Ctrl+C mid-write truncates the store; drain first, exit second.
• Dev dependencies in production — bloated images and attack surface; --omit=dev is not optional.
• No health check or logs — you cannot fix what you cannot see; ship both from day one.

Practice checklist

1. Move every secret into environment variables and commit a documented .env.example.
2. Write two passing tests and one deliberately failing test; read the TAP output for the failure detail.
3. Add /healthz and verify it with curl before and after a request burst.
4. Trigger SIGTERM during a slow request and confirm the response still completes.
5. Deploy the app anywhere — even a free tier — and confirm the health check, HTTPS and a restart cycle all behave.

Congratulations: you read, wrote, persisted, exposed and shipped a real Node.js service. Keep the momentum going in the JavaScript best practices chapter, or browse everything else on the tutorials index.