All 15 Express & Middleware questions
More in Express & Middleware
What is the purpose of the express.static() built-in middleware, and how would you use it to serve a folder of static assets? What is middleware in Express, and what is the significance of the order in which middleware is registered? What is the difference between application-level, router-level, and route-specific middleware in Express? What does the express.json() and express.urlencoded() built-in middleware do, and why must it be registered before routes that need to read req.body? What is CORS middleware in Express, and how does the cors package simplify configuring Cross-Origin Resource Sharing? What is the difference between res.send(), res.json(), and res.end() in Express, and when should each be used? How do you write custom Express middleware that needs to perform asynchronous work, like checking a value against a database, before calling next()? How would you implement request validation middleware in Express using a schema-validation library like Zod or Joi? How would you implement a request-logging middleware in Express that captures method, path, status code, and response time for every request? How would you structure a large Express application using the Router to organize routes into feature-based or resource-based modules?
Advertisement
Node.js › Express & Middleware

What is the purpose of the helmet middleware package for an Express application, and what specific security headers does it set?

Intermediate

Answer

helmet sets several HTTP response headers that provide baseline protection against common web vulnerabilities with minimal configuration -- including Content-Security-Policy (restricting what resources a page can load, mitigating XSS), X-Frame-Options (preventing clickjacking by controlling whether the page can be embedded in an iframe), Strict-Transport-Security (forcing browsers to only connect via HTTPS), and X-Content-Type-Options (preventing MIME-type sniffing attacks) -- collectively raising an Express app's baseline security posture with a single line of middleware.
const helmet = require('helmet');
app.use(helmet()); // applies a sensible set of security headers by default

// Customizing a specific header's behavior
app.use(helmet({ contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } } }));
Real-world example A security review of a production Express API recommends adding helmet as one of the first, easiest improvements, immediately gaining protection against clickjacking, MIME-sniffing, and several other common attack vectors with a single line of middleware configuration.

Common follow-ups: Which of helmet's default headers might need customization for an API serving embeddable widgets meant to be placed in an iframe?;How does Content-Security-Policy specifically help mitigate XSS attacks?

Security;HTTP & HTTPS Modules
All 15 Express & Middleware questions