JAVASCRIPT
Configure Essential Security HTTP Headers in Node.js Express with Helmet
Strengthen your web application's defenses against common attacks by easily setting crucial HTTP security headers using the `helmet` middleware in Express.js.
const express = require('express');
const helmet = require('helmet');
const app = express();
// Use Helmet to set various HTTP headers for security
app.use(helmet());
// You can customize individual headers if needed
// app.use(helmet.contentSecurityPolicy({
// directives: {
// defaultSrc: ["'self'"],
// scriptSrc: ["'self'", "'unsafe-inline'"], // Be careful with 'unsafe-inline'
// // Further directives...
// },
// }));
// app.use(helmet.frameguard({ action: 'deny' })); // Prevents clickjacking
app.get('/', (req, res) => {
res.send('Hello Secure World!');
});
app.listen(3000, () => {
console.log('Secure server running on port 3000');
});
How it works: This snippet demonstrates how to easily implement a suite of security-related HTTP headers in an Express.js application using the `helmet` middleware. `helmet` helps protect your app from common web vulnerabilities by setting headers like `X-Content-Type-Options`, `X-DNS-Prefetch-Control`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Download-Options`, `Cache-Control`, `Pragma`, and `Expires`. These headers mitigate attacks such as XSS, clickjacking, and insecure connections.