portfolio-page/backend

Audit request endpoint

Small Express service that receives the form on /de/audit and forwards it by email. It is deployed separately from the static site: the website is built with Vite and uploaded by FTP, this service runs on the VPS.

Its dependencies are intentionally kept out of the frontend package.json so they never end up in the browser bundle.

Endpoints

Method	Path	Purpose
GET	/health	Liveness probe
POST	/api/audit-request	Accepts one audit request

Expected JSON body:

{
  "name": "…",
  "email": "…",
  "url": "https://…",
  "role": "agency | client",
  "motivation": "…",
  "gdprConsent": "true",
  "website": ""
}

website is a honeypot and must stay empty. A filled honeypot is answered with 200 on purpose so bots learn nothing and do not retry.

Setup

cd backend
npm install
cp .env.example .env   # then fill in the SMTP credentials
npm start

The process binds to 127.0.0.1 only. Put nginx in front of it with TLS, for example on api.sascha-bach.de, and proxy to the port from .env.

Then point the frontend at it by setting VITE_AUDIT_ENDPOINT before building:

VITE_AUDIT_ENDPOINT=https://api.sascha-bach.de/api/audit-request npm run build

If the CSP connect-src in public/.htaccess names a different host than the one you deploy to, the browser blocks the request - keep the two in sync.

Protections in place

• CORS allowlist from ALLOWED_ORIGINS, never *
• Rate limit: 3 requests per IP per 15 minutes
• Request body capped at 10 kB
• Server-side validation of every field (express-validator)
• Honeypot field
• Consent is required, not assumed
• CR/LF stripped from values used in mail headers, HTML escaped in the body
• No personal data written to logs

app.set('trust proxy', 1) assumes exactly one proxy hop (nginx). Adjust it if you add a second one, otherwise the rate limiter sees a single IP for everyone.