Implement a Strict Content Security Policy (CSP) Header

const express = require('express');
const helmet = require('helmet'); // Helmet helps secure Express apps by setting various HTTP headers

const app = express();

// Use Helmet to set security headers, including CSP
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"], // Only allow resources from the same origin
    scriptSrc: ["'self'", "https://trusted-cdn.com"], // Allow scripts from self and a specific CDN
    styleSrc: ["'self'", "'unsafe-inline'"], // Allow styles from self and inline styles (use with caution)
    imgSrc: ["'self'", "data:", "https://img.example.com"], // Allow images from self, data URIs, and a specific domain
    connectSrc: ["'self'", "https://api.example.com"], // Allow API calls to self and a specific API domain
    objectSrc: ["'none'"], // Disallow <object>, <embed>, <applet>
    frameSrc: ["'self'", "https://trusted-iframe.com"], // Allow iframes from self and a trusted source
    upgradeInsecureRequests: [], // Automatically upgrade HTTP requests to HTTPS
  },
}));

app.get('/', (req, res) => {
  res.send('Hello, secure world!');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});