Shipping a MERN app to production

Shipping a MERN app to real users is a different bar than running it on localhost. Work through this before your first deploy — it covers the things that break in production but never show up in development.

Environment & config

• Load config from the environment — never hardcode URLs, ports, or keys.
• Validate required env vars at startup and fail fast if any are missing.
• Keep secrets out of git — use a secrets manager or platform env vars, and rotate anything that leaked.
• Set NODE_ENV=production so Express and dependencies use their optimized paths.

// fail fast if config is missing — better a clear crash than silent bugs
const required = ["MONGO_URI", "JWT_SECRET", "PORT"]
for (const key of required) {
  if (!process.env[key]) throw new Error(`Missing env var: ${key}`)
}

Security

• Enforce HTTPS and set security headers (e.g. with a headers middleware).
• Authenticate and authorize every non-public route.
• Validate and sanitize all input at the boundary.
• Rate-limit auth and public endpoints.
• Lock down CORS to known origins.

Database

• Use a managed MongoDB with backups and monitoring enabled.
• Index the fields you query and sort — verify with explain().
• Reuse a single connection pool; don't reconnect per request.
• Restrict database network access to your app, not the public internet.

Performance

• Run Node behind a process manager with clustering and graceful shutdown.
• Enable gzip/brotli compression for responses.
• Cache hot reads where it makes sense; add a CDN for static assets.
• Build the React client for production and serve it minified.

Error handling & logging

• Add a central error-handling middleware that returns safe responses.
• Never expose stack traces or internals to clients.
• Log structured errors and handle unhandledRejection / uncaughtException.
• Report errors to a tracking service.

Observability

• Add a health-check endpoint for your platform's probes.
• Collect metrics and request logs so you can diagnose issues.
• Set up alerts on error rate and latency.

Pre-deploy checklist

• Config from env, required vars validated, secrets out of git
• HTTPS, headers, auth, validation, rate limiting, CORS in place
• Managed DB with backups, indexes, and restricted access
• Process manager, compression, caching, production client build
• Central error handler, structured logs, error reporting
• Health check, metrics, and alerts wired up

FAQ