Implement Essential Security Headers in Node.js Express

const express = require('express');
const helmet = require('helmet'); // Helmet helps secure Express apps by setting various HTTP headers

const app = express();
const port = 3000;

// Use Helmet middleware to set security headers
app.use(helmet());

// Helmet applies most common security headers by default.
// However, you can also set individual headers if needed or customize Helmet's defaults.

// 1. HTTP Strict Transport Security (HSTS) - Force HTTPS
// Helmet sets HSTS by default, but you can configure it:
app.use(helmet.hsts({
  maxAge: 31536000, // 1 year in seconds
  includeSubDomains: true, // Apply to subdomains as well
  preload: true // Recommend your domain to be included in browser HSTS preload list
}));

// 2. X-Frame-Options - Prevent Clickjacking
// Helmet sets 'DENY' by default. You can customize to 'SAMEORIGIN' if needed.
app.use(helmet.frameguard({ action: 'DENY' })); // or 'SAMEORIGIN'

// 3. X-Content-Type-Options - Prevent MIME-sniffing
// Helmet sets 'nosniff' by default.
app.use(helmet.noSniff());

// 4. X-XSS-Protection - Enable browser's built-in XSS filter
// Note: Modern browsers have removed or deprecated support for this header
// due to security concerns (it could introduce XSS vulnerabilities itself).
// CSP is the preferred modern approach for XSS protection.
// Helmet removes this header by default for modern browser safety,
// but you might encounter it in legacy codebases.
// app.use(helmet.xssFilter()); // Generally not recommended anymore

// 5. Referrer-Policy - Control how much referrer information is sent
// Helmet sets 'no-referrer' by default for security, but often 'same-origin' or 'no-referrer-when-downgrade' is used.
app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));


// Other Helmet headers (automatically set by app.use(helmet())):
// - Content-Security-Policy (CSP): Needs manual configuration for each app if used via Helmet, or use a specific CSP middleware.
//   `helmet.contentSecurityPolicy` allows fine-grained control.
// - Expect-CT
// - X-DNS-Prefetch-Control
// - X-Download-Options
// - Permitted-Cross-Domain-Policies

app.get('/', (req, res) => {
  res.send('Hello, secure web!');
});

app.listen(port, () => {
  console.log(`Secure app listening at http://localhost:${port}`);
});