mediumBackend

What is Helmet and which HTTP security headers should a Node.js API set?

Q: What is Helmet and which HTTP security headers should a Node.js API set?

**TL;DR.** **Helmet** is Express middleware that sets defensive **HTTP headers** with sane defaults: Content-Security-Policy , Strict-Transport-Security (HSTS), X-Content-Type-Options , X-Frame-Options , and Referrer-Policy . They reduce XSS, clickjacking, MIME-sniffing, and protocol-downgrade risks with one line. helmet() Content-Security-Policy Strict-Transport-Security (HSTS) <text class='d-sub

946 views

Understand the problem

Hardening responses with security headers.

nodejssecurityhelmetheaders

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Helmet with a tuned CSP

import helmet from 'helmet';

app.use(helmet());                       // sensible defaults
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", 'https://cdn.example.com'],
    frameAncestors: ["'none'"],          // anti-clickjacking
  },
}));
app.disable('x-powered-by');             // hide framework fingerprint

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What are Promises in Node.js and how do they improve async code?

What is the difference between "type": "module", .mjs, and .cjs?