Node.js Course
Node.js
/
Beginner

Helmet.js

Definition

A popular Express middleware collection that helps secure Node.js apps by setting various HTTP headers to defend against common web vulnerabilities.

Explain Like I'm New

When you start an Express server, it leaves a lot of security doors unlocked by default. It even broadcasts `X-Powered-By: Express` to the world, telling hackers exactly what vulnerabilities to look for. Helmet is a security guard that runs through the building, locking doors, disabling vulnerable legacy features, and removing the Express nametag.

Real World Example

Protecting against Clickjacking. Helmet sets the `X-Frame-Options` header to `DENY`, making it impossible for a hacker to embed your website inside an invisible `<iframe>` on their malicious site.

Common Use Cases

  • •Baseline API security
  • •Passing penetration tests

Terminal Output

bash / terminal
/* npm install helmet */ // const express = require('express'); // const helmet = require('helmet'); // const app = express(); // // Enable basic security features with one line of code // app.use(helmet()); // console.log("Helmet automatically adds headers like:"); // console.log("- Strict-Transport-Security (Forces HTTPS)"); // console.log("- X-Content-Type-Options (Prevents MIME sniffing)"); // console.log("- X-Frame-Options (Prevents Clickjacking)"); console.log("Helmet is universally recommended for all production Express applications.");

Interview Questions

basic

  • What does the `helmet()` middleware do?

intermediate

  • What is Content Security Policy (CSP)?

Flash Cards

Question

What does it do?

Click to reveal answer
Answer

It is actually a wrapper around 15 smaller middlewares. By calling `app.use(helmet())`, you automatically set 15 secure HTTP headers to protect against XSS, clickjacking, and sniffing.

Question

What is CSP?

Click to reveal answer
Answer

A powerful header set by Helmet that dictates exactly which domains your website is allowed to load scripts, images, and fonts from. If a hacker injects an XSS script into your site, CSP will block the browser from executing it because the script didn't come from your approved domain list.