Know the boundary you are opening.

Before network exposure

Start local, then change one boundary at a time.

1. Keep loopback for local tools.The default host:'127.0.0.1' accepts connections only from this machine.
2. Set an external bind deliberately.host:'0.0.0.0' or --host 0.0.0.0 listens on IPv4 interfaces. Connect through the machine's real interface address.
3. Apply network controls.Configure firewall, container, VM, or platform ingress to expose only the intended port and sources.
4. Put edge controls at the proxy.node-http-server focuses on static serving and Host/root routing. Add authentication, authorization, rate limits, WAF policy, and certificate automation at the reverse proxy or hosting edge.
5. Set body/time protections.Choose finite request limits and timeouts for expected traffic. The body cap is unlimited until configured.
6. Review the served root.Keep secrets, source maps, private keys, logs, and unrelated files outside every configured root.
7. Keep dotfiles blocked.The default rejects every dot-prefixed segment. Set allowDotfiles:true only after auditing the complete dedicated root.
8. Protect logs and TLS keys.Restrict filesystem access and never serve their directories.

Static HTTP + HTTPS contract

Expected request behavior.

Failure map

Translate status or process errors into the next check.

Clean shutdown

Stop accepting work before process exit.

import {Server} from 'node-http-server';

const server=new Server({
    root:'./public',
    host:'127.0.0.1',
    port:8080
}).deploy();

for(const signal of ['SIGINT','SIGTERM']){
    process.once(signal,async()=>{
        await server.close();
    });
}

The CLI handles SIGINT (exit 130) and SIGTERM (exit 0) after closing owned listeners. Library applications decide their own signal policy. Repeated/concurrent close() calls are safe and share in-flight close work.

Request logs

Keep records useful and protected.

Redaction covers known credential fields. URLs, addresses, custom headers, and deliberately logged bodies can still contain sensitive data.

Certificates

Generate local material outside the served root.

1. Create a local certificate directory.Keep the private subdirectory ignored and outside every static root.
2. Generate a new private key and certificate.Use the local certificate instructions for development, or your deployment's certificate authority for production.
3. Pass paths through the module API.HTTPS configuration is available through the module API.
4. Protect and rotate.Use restrictive permissions and replace compromised or expired keys.

Migrating from v9 to v10

Review HTTPS integrations for 10.0.0.

Configured HTTPS defaults to HTTP/2 with HTTP/1.1 negotiation on the same port. Existing key and certificate paths still configure the listener; plain HTTP and the CLI remain HTTP/1.1.

Earlier v8-to-v9 migration

Handle the earlier deliberate changes.

Security reporting

Report privately when possible.

Use the repository's private vulnerability reporting channel when it is available. Otherwise contact the maintainer without publishing exploit details, keys, credentials, or sensitive logs in a public issue.