Implement Essential HTTP Security Headers in Node.js with Helmet

const express = require('express');
const helmet = require('helmet');
const app = express();
const PORT = 3000;

// Use Helmet middleware to set various HTTP headers for security
app.use(helmet());

// Helmet sets most security headers by default. You can customize them if needed.
// Example of custom configuration for specific headers:
app.use(helmet.frameguard({ action: 'deny' })); // Prevents clickjacking by blocking IFRAME embedding
app.use(helmet.xssFilter()); // Adds X-XSS-Protection header for browser's XSS filter
app.use(helmet.noSniff()); // Prevents browsers from MIME-sniffing a response away from the declared content-type
app.use(helmet.hsts({
  maxAge: 31536000, // 1 year in seconds
  includeSubDomains: true,
  preload: true
})); // Enforces secure (HTTPS) connections to the server

// Note: Content Security Policy (CSP) is handled by helmet.contentSecurityPolicy().
// It's a powerful but complex header. For basic setup without CSP:
// app.use(helmet.contentSecurityPolicy({
//   directives: {
//     defaultSrc: ["'self'"],
//     scriptSrc: ["'self'"],
//     // ... other directives
//   }
// }));

app.get('/', (req, res) => {
  res.send('Hello Secure World!');
});

app.listen(PORT, () => {
  console.log(`Server running with security headers on http://localhost:${PORT}`);
  console.log('Test headers with: curl -I http://localhost:3000');
});