express.static dotfiles option: preventing accidental exposure of .env and .git under a shared root

Answer the question first

In Express 4.x (and the current Express 5.x beta) the built‑in express.static middleware will only honour the dotfiles option for files that begin with a dot. It does not perform any check that the supplied root does not contain other sensitive siblings. The root is resolved against process.cwd() unless you give an absolute path. Therefore, if you run the app from a directory that is the parent of .env or a .git folder, the middleware could resolve those files and serve them (unless dotfiles: 'ignore' blocks the dotfile itself).

Express does not validate the root against an allowlist, nor does the fallthrough option help you “fail closed”. The only framework‑level guarantee is that dotfiles: 'ignore' will return 404 for dotfiles; everything else is up to how you configure the root.

Confirmed facts

• Express 4.x uses the serve-static package, which in turn uses the send library to resolve paths and guard against directory traversal.
• When you pass a relative path to express.static, it is resolved against process.cwd() at runtime.
• Express 5.x keeps the same API and behaviour for express.static; no new security guarantees are added.

Practical strategy for a fail‑closed root

1. Compute an absolute root at startup:

   const path = require('path');
   const staticRoot = path.resolve(__dirname, 'public');
   app.use(express.static(staticRoot, { dotfiles: 'ignore', fallthrough: false }));

   This guarantees the root is always the same, regardless of where the process is launched.
2. Add a pre‑static guard middleware:

   const path = require('path');
   const allowedRoot = path.resolve(__dirname, 'public');
   app.use((req, res, next) => {
     const resolved = path.resolve(allowedRoot, '.' + req.path);
     if (!resolved.startsWith(allowedRoot)) {
       return res.status(403).send('Forbidden');
     }
     next();
   });

   The guard runs before express.static and rejects any request that would resolve outside the intended directory.
3. Keep dotfiles: 'ignore' to block dotfile URLs: Even with the guard, it is good practice to keep the default to avoid accidental exposure of files that start with a dot.
4. Verify the configuration: Log the absolute root on startup and test a curl request to /../.env or /../.git from a client. You should see a 403 from the guard or a 404 from dotfiles: 'ignore'.

What to ask next

If you are already using an absolute path for express.static and still see a potential for sibling exposure, confirm whether your deployment changes process.cwd() or moves the root directory relative to __dirname. That detail can change the recommendation slightly.