Production configuration

Vendure logs a warning at startup if it finds the reflect-any-origin default in place. The warning is most important when you also set authOptions.cookieOptions.sameSite to 'none' or when you use tokenMethod: 'bearer', because neither of those relies on the SameSite cookie rules that otherwise limit the impact. See the Security guide for the full explanation.

API hardening

It is recommended that you install and configure the HardenPlugin for all production deployments. This plugin locks down your schema (disabling introspection and field suggestions) and protects your Shop API against malicious queries that could otherwise overwhelm your server.

Install the plugin:

Then add it to your VendureConfig:

ID Strategy

By default, Vendure uses auto-increment integer IDs as entity primary keys. While easier to work with in development, sequential primary keys can leak information such as the number of orders or customers in the system.

For this reason you should consider using the UuidIdStrategy for production.

Another option, if you wish to stick with integer IDs, is to create a custom EntityIdStrategy which uses the encodeId() and decodeId() methods to obfuscate the sequential nature of the ID.

Database Timezone

Vendure internally treats all dates & times as UTC. However, you may sometimes run into issues where dates are offset by some fixed amount of hours. E.g. you place an order at 17:00, but it shows up in the Dashboard as being placed at 19:00. Typically, this is caused by the timezone of your database not being set to UTC.

You can check the timezone in MySQL/MariaDB by executing:

and you should expect to see 00:00:00.

In Postgres, you can execute:

and you should expect to see UTC or Etc/UTC.

Trust proxy

When deploying your Vendure application behind a reverse proxy (usually the case with most hosting services), consider configuring Express's trust proxy setting. This allows you to retrieve the original IP address from the X-Forwarded-For header, which proxies use to forward the client's IP address.

You can set the trustProxy option in your VendureConfig:

For more details on configuring trust proxy, refer to the Express documentation.

Security Considerations

Please read over the Security section of the Developer Guide for more information on how to secure your Vendure application.