This project is a secure API gateway built using Node.js and Express. It protects backend services from attacks such as DDoS, brute-force login attempts, and endpoint abuse.
The system uses layered security mechanisms including rate limiting and behavior-based threat detection to monitor incoming traffic and block malicious users.
- JWT Authentication
- Role-based Access Control
- Rate Limiting
- DDoS Protection
- Behavior-based Threat Detection
- MongoDB Logging
- Geo IP Tracking
- Top Attackers Analytics
Client → API Gateway → Security Layer → MongoDB
Authentication:
- POST /api/login
Protected Routes:
- GET /api/data
- GET /api/admin
Monitoring:
- GET /api/logs
- GET /api/stats
- GET /api/top-attackers
-
Clone the repository
-
Install dependencies npm install
-
Create a .env file MONGO_URI=your_mongodb_connection JWT_SECRET=your_secret
-
Start the server node server.js
- Send requests to /api/login
- Use the token to access protected routes
- Simulate multiple requests to trigger blocking
- Verify logs and stats APIs
This system demonstrates how API gateways can be secured against common attack patterns using monitoring, detection, and automated blocking.
Node.js Express.js MongoDB Mongoose
Shreyas Bhat