Helmet for security headers in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of using Helmet's default configuration in an Express app?

Consider an Express app that uses app.use(helmet()) with no options. What does this do?

Express

const express = require('express');
const helmet = require('helmet');
const app = express();
app.use(helmet());
app.get('/', (req, res) => res.send('Hello'));
app.listen(3000);

A It sets a collection of common security headers with default safe values.

B It automatically redirects all HTTP requests to HTTPS.

C It only sets the Content-Security-Policy header with a strict policy.

D It disables all HTTP headers to improve performance.

💡 Hint

Think about what Helmet does by default without extra options.

Helmet by default sets multiple security headers like X-DNS-Prefetch-Control, X-Frame-Options, Strict-Transport-Security, and others with safe defaults to protect the app.

📝 Syntax

intermediate

Which Helmet middleware usage is syntactically correct to disable the Content Security Policy?

You want to disable the Content Security Policy (CSP) middleware in Helmet. Which code snippet is correct?

A app.use(helmet({ contentSecurityPolicy: false }));

B app.use(helmet.disable('contentSecurityPolicy'));

C app.use(helmet({ disable: ['contentSecurityPolicy'] }));

D app.use(helmet().contentSecurityPolicy(false));

💡 Hint

Check Helmet's option object syntax for disabling specific middleware.

Helmet accepts an options object where setting contentSecurityPolicy: false disables that middleware.

🔧 Debug

advanced

Why does this Helmet setup cause a runtime error?

Review this code snippet and identify why it throws an error when starting the server.

Express

const express = require('express');
const helmet = require('helmet');
const app = express();
app.use(helmet.contentSecurityPolicy());
app.listen(3000);

A helmet middleware must be used after app.listen, not before.

B helmet.contentSecurityPolicy requires options and cannot be called without arguments.

C helmet.contentSecurityPolicy is not a function; it must be called from helmet() or imported separately.

D helmet.contentSecurityPolicy is deprecated and removed in latest versions.

💡 Hint

Check how Helmet middleware functions are accessed.

helmet.contentSecurityPolicy is not directly callable unless imported separately. The correct way is to use helmet() or import the middleware from 'helmet'.

❓ state_output

advanced

What headers are set after this Helmet configuration?

Given this Express app code, which security header will NOT be set?

Express

const express = require('express');
const helmet = require('helmet');
const app = express();
app.use(helmet({
  frameguard: false,
  dnsPrefetchControl: false
}));
app.get('/', (req, res) => res.send('OK'));
app.listen(3000);

A Strict-Transport-Security header is NOT set.

B All default Helmet headers are set.

C Content-Security-Policy header is NOT set.

D X-Frame-Options and X-DNS-Prefetch-Control headers are NOT set.

💡 Hint

Look at which middleware are disabled explicitly.

Setting frameguard: false and dnsPrefetchControl: false disables those headers. Other default headers remain set.

🧠 Conceptual

expert

Why is it important to configure Helmet's Content Security Policy carefully in a React app?

In a React single-page app served by Express with Helmet, why must the Content Security Policy (CSP) be configured carefully?

A Because Helmet disables React's rendering lifecycle when CSP is enabled.

B Because a strict CSP can block inline scripts and styles React relies on, causing the app to break.

C Because CSP automatically disables React's state management if misconfigured.

D Because CSP only affects server-side code and has no impact on React apps.

💡 Hint

Think about what CSP blocks and how React uses scripts and styles.

React apps often use inline scripts or styles during development or runtime. A strict CSP without allowing these will block them, breaking the app.