Implementing Essential Security Headers with Helmet.js in Express

const express = require('express');
const helmet = require('helmet');

const app = express();

// Use Helmet.js to set a variety of HTTP headers for security
app.use(helmet());

// You can configure specific Helmet middleware as needed
// For example, if you need to allow framing from same origin:
// app.use(helmet.frameguard({ action: 'sameorigin' }));

// You can also disable specific headers if they conflict with your app
// app.use(helmet({
//   referrerPolicy: false,
//   contentSecurityPolicy: false, // CSP is better configured via a dedicated module or Nginx for fine-grained control
// }));

// Set HSTS explicitly with a custom maxAge and includeSubDomains
// Helmet's default HSTS is 180 days (15552000 seconds) without includeSubDomains
app.use(helmet.hsts({
  maxAge: 31536000, // 1 year in seconds
  includeSubDomains: true,
  preload: true
}));

app.get('/', (req, res) => {
  res.send('Hello from a secure Express app!');
});

// Endpoint to demonstrate header effect (check browser dev tools -> Network tab)
app.get('/headers', (req, res) => {
  res.json({ message: 'Check the response headers in your browser developer tools.' });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
  console.log('Open http://localhost:3000/headers and inspect the response headers.');
});