Secure Backend Implementation (Node.js)

// server.js - Secure backend proxy
const express = require('express');
const rateLimit = require('express-rate-limit');
const helmet = require('helmet');

const app = express();

// Security middleware
app.use(helmet());
app.use(express.json({ limit: '10mb' }));

// Rate limiting
const chatLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 50, // 50 requests per 15 minutes
  message: 'Too many chat requests, please try again later'
});

app.use('/api/chat', chatLimiter);

// Chat endpoint
app.post('/api/chat', async (req, res) => {
  try {
    const { message, conversationId } = req.body;
    
    // Validate input
    if (!message || message.length > 1000) {
      return res.status(400).json({ error: 'Invalid message' });
    }
    
    // Sanitize input
    const sanitizedMessage = message.replace(/<script[^>]*>.*?<\/script>/gi, '');
    
    // Call AI API (with your secret key)
    const response = await fetch('https://api.groq.com/openai/v1/chat/completions', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${process.env.GROQ_API_KEY}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        model: 'llama-3.1-8b-instant',
        messages: [
          {
            role: 'system',
            content: 'You are a helpful assistant. Be concise and professional.'
          },
          {
            role: 'user',
            content: sanitizedMessage
          }
        ],
        temperature: 0.7,
        max_tokens: 200
      })
    });
    
    const data = await response.json();
    const aiResponse = data.choices[0].message.content;
    
    // Content filtering (implement your own logic)
    if (containsInappropriateContent(aiResponse)) {
      return res.json({
        response: "I'm sorry, I can't help with that. Please contact our support team."
      });
    }
    
    res.json({ response: aiResponse });
    
  } catch (error) {
    console.error('Chat API error:', error);
    res.status(500).json({
      error: 'Sorry, I'm experiencing technical difficulties. Please try again.'
    });
  }
});

function containsInappropriateContent(text) {
  // Implement your content filtering logic
  const inappropriatePatterns = [
    /harmful content patterns/i,
    // Add your patterns
  ];
  
  return inappropriatePatterns.some(pattern => pattern.test(text));
}

app.listen(3000, () => {
  console.log('Chat server running on port 3000');
});