Add HTTP Security Headers with Helmet in Express.js

const express = require('express');
const helmet = require('helmet'); // npm install helmet
const app = express();

// Use Helmet to set various HTTP headers for security
app.use(helmet());

// You can customize individual headers if needed.
// Example: Content Security Policy (CSP)
app.use(helmet.contentSecurityPolicy({
    directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "https://trusted-cdn.com"],
        styleSrc: ["'self'", "https://trusted-styles.com"],
        imgSrc: ["'self'", "data:", "https://trusted-images.com"],
        formAction: ["'self'"],
        objectSrc: ["'none'"], // Prevent flash/java applets
        upgradeInsecureRequests: [], // Automatically rewrite HTTP requests to HTTPS
    },
}));

// Example: Frameguard (X-Frame-Options) to prevent clickjacking
// app.use(helmet.frameguard({ action: 'deny' })); // 'deny' or 'sameorigin'

// Example: X-Content-Type-Options to prevent MIME-sniffing
// app.use(helmet.noSniff());

// Example: HSTS (Strict-Transport-Security) for HTTPS enforcement
// app.use(helmet.hsts({
//     maxAge: 31536000, // 1 year in seconds
//     includeSubDomains: true,
//     preload: true
// }));


app.get('/', (req, res) => {
    res.send('Hello Secure World!');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
    console.log(`Server running with security headers on port ${PORT}`);
});