Node.js
/Beginner
Helmet.js
Definition
A popular Express middleware collection that helps secure Node.js apps by setting various HTTP headers to defend against common web vulnerabilities.
Explain Like I'm New
When you start an Express server, it leaves a lot of security doors unlocked by default. It even broadcasts `X-Powered-By: Express` to the world, telling hackers exactly what vulnerabilities to look for. Helmet is a security guard that runs through the building, locking doors, disabling vulnerable legacy features, and removing the Express nametag.
Real World Example
Protecting against Clickjacking. Helmet sets the `X-Frame-Options` header to `DENY`, making it impossible for a hacker to embed your website inside an invisible `<iframe>` on their malicious site.
Common Use Cases
- •Baseline API security
- •Passing penetration tests
Terminal Output
bash / terminal
/*
npm install helmet
*/
// const express = require('express');
// const helmet = require('helmet');
// const app = express();
// // Enable basic security features with one line of code
// app.use(helmet());
// console.log("Helmet automatically adds headers like:");
// console.log("- Strict-Transport-Security (Forces HTTPS)");
// console.log("- X-Content-Type-Options (Prevents MIME sniffing)");
// console.log("- X-Frame-Options (Prevents Clickjacking)");
console.log("Helmet is universally recommended for all production Express applications.");
Interview Questions
basic
- What does the `helmet()` middleware do?
intermediate
- What is Content Security Policy (CSP)?