App Hardening

[fcaps]

see: https://expressjs.com/en/advanced/best-practice-security.html

[Brutus5000]

• TLS is solved by our reverse proxy
• Prevent brute-force attacks against authorization is solved in the user service
• Deprecated versions / unsafe dependencies is what dependabot should help with.

Not sure what actions remain.

[fcaps]

some steps like:

• session cookie name
• helmet http headers (maybe we need not all, but some of them)
• app.disable('x-powered-by') lel, opensource... you can't hide

and search/remove unused libs that are loaded, but not used (browser)