Configure Essential HTTP Security Headers with Node.js Helmet

// First, install Express and Helmet: npm install express helmet

const express = require('express');
const helmet = require('helmet');
const app = express();

// Use Helmet middleware
// This adds several security headers by default:
// Content-Security-Policy, X-DNS-Prefetch-Control,
// Expect-CT, X-Frame-Options, X-Powered-By (removes),
// Strict-Transport-Security, X-Download-Options,
// X-Content-Type-Options, X-Permitted-Cross-Domain-Policies,
// Referrer-Policy
app.use(helmet());

// You can also configure specific headers
// Example: Customizing Content Security Policy (CSP)
app.use(
  helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://cdn.example.com"],
      styleSrc: ["'self'", "'unsafe-inline'"], // Generally avoid 'unsafe-inline' in production
      imgSrc: ["'self'", "data:", "https://images.example.com"],
      connectSrc: ["'self'", "https://api.example.com"],
    },
  })
);

// Example: Configuring Strict-Transport-Security (HSTS)
// This tells browsers to only connect to your site using HTTPS
app.use(
  helmet.hsts({
    maxAge: 31536000, // 1 year in seconds
    includeSubDomains: true, // Apply to subdomains too
    preload: true, // Allows preloading to browser HSTS lists
  })
);

// Example: X-Frame-Options (prevents clickjacking) - Helmet sets this by default to 'DENY'
// app.use(helmet.frameguard({ action: 'deny' }));


app.get('/', (req, res) => {
  res.send('Hello Secure Web!');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running securely on port ${PORT}`);
});