Implementing a Strong Content Security Policy (CSP)

const express = require('express');
const helmet = require('helmet'); // Helmet helps secure Express apps by setting various HTTP headers

const app = express();

// Use Helmet's CSP middleware
app.use(
  helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"], // Only allow resources from the same origin by default
      scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'", "https://trusted-cdn.com"], // Allow self, specific inline scripts/evals, and a trusted CDN
      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"], // Allow self, specific inline styles, and Google Fonts
      imgSrc: ["'self'", "data:", "https://img.example.com"], // Allow self, data URIs, and a specific image host
      fontSrc: ["'self'", "https://fonts.gstatic.com"], // Allow self and Google Fonts
      objectSrc: ["'none'"], // Disallow <object>, <embed>, <applet>
      baseUri: ["'self'"], // Restrict base URI
      formAction: ["'self'"], // Restrict form submissions to self
      frameAncestors: ["'none'"], // Prevent clickjacking (e.g., via iframes)
      upgradeInsecureRequests: [], // Automatically upgrade insecure HTTP requests to HTTPS
      blockAllMixedContent: [], // Block all insecure HTTP requests on HTTPS pages
    },
  })
);

app.get('/', (req, res) => {
  res.send('<h1>Hello, Secure Web!</h1><script>console.log("This script is allowed if inline scripts are enabled or a hash/nonce is used.");</script>');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
  console.log('Check network tab in browser for Content-Security-Policy header.');
});

// To run:
// 1. npm init -y
// 2. npm install express helmet
// 3. node your_file_name.js