# Securing Node.js services and their broker

Source: https://imqueue.org/blog/topics/security/

Security articles for Node.js service fleets: encrypting the Redis broker connection with TLS, least-privilege Redis ACL users for a message queue, and checking a caller's IP against thousands of allowed networks.

3 articles tagged `security`, newest first.

- [Least privilege for your Redis broker: the ACL a Node.js service fleet actually needs](https://imqueue.org/blog/redis-acl-least-privilege-nodejs/) — 2026-09-18, Mykhailo Stadnyk: TLS decides who can listen to your broker. It says nothing about what a connected process may do after it is in — and on a Redis left at its defaults the answer is everything, including FLUSHALL. Here is the exact rule set an @imqueue fleet needs, the permissions that look optional and quietly are not, and how to rotate the password without a restart storm. Every behaviour is measured. — [markdown](https://imqueue.org/blog/redis-acl-least-privilege-nodejs/index.md)
- [Meeting compliance: how to talk to your Redis broker over TLS](https://imqueue.org/blog/tls-redis-broker-nodejs/) — 2026-09-01, Mykhailo Stadnyk: The questionnaire asks whether data is encrypted in transit, and you know the answer for the edge. Then you remember the broker — the one connection every service holds open all day, carrying every argument and every return value, and speaking a protocol that puts them on the wire as text. Here is what encrypting it takes, what it costs, and the two places it is easy to get wrong. — [markdown](https://imqueue.org/blog/tls-redis-broker-nodejs/index.md)
- [Checking an IP against 10,000 networks without comparing it to 10,000 networks](https://imqueue.org/blog/ip-allow-lists-cidr-nodejs/) — 2026-08-28, Mykhailo Stadnyk: Every request asks the same question — is this one of ours? — and the loop you wrote to answer it gets slower every time someone adds a partner range. Here is how to answer it in logarithmic time instead, what an address really is once you stop treating it as a string, and the quiet precondition that a fast implementation must uphold or it will lie to you. — [markdown](https://imqueue.org/blog/ip-allow-lists-cidr-nodejs/index.md)

## Other topics

- [Message queues](https://imqueue.org/blog/topics/queue/) — 18 articles
- [RPC](https://imqueue.org/blog/topics/rpc/) — 14 articles
- [Patterns](https://imqueue.org/blog/topics/patterns/) — 12 articles
- [Architecture](https://imqueue.org/blog/topics/architecture/) — 11 articles
- [Comparisons](https://imqueue.org/blog/topics/comparison/) — 9 articles
- [Developer experience](https://imqueue.org/blog/topics/dx/) — 8 articles
- [Resilience](https://imqueue.org/blog/topics/resilience/) — 8 articles
- [Type safety](https://imqueue.org/blog/topics/types/) — 7 articles
- [Performance](https://imqueue.org/blog/topics/performance/) — 6 articles
- [Transports](https://imqueue.org/blog/topics/transport/) — 6 articles
- [Message delivery](https://imqueue.org/blog/topics/delivery/) — 5 articles
- [Jobs & scheduling](https://imqueue.org/blog/topics/jobs/) — 5 articles
- [Typed clients](https://imqueue.org/blog/topics/clients/) — 4 articles
- [Service discovery](https://imqueue.org/blog/topics/discovery/) — 3 articles

All articles: [https://imqueue.org/blog/](https://imqueue.org/blog/) — [markdown](https://imqueue.org/blog/index.md)