Helmet for security headers in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import Helmet in an Express app.

Express

const express = require('express');
const [1] = require('helmet');
const app = express();

Drag options to blanks, or click blank then click option'

Ahelmet

Bexpress

Ccors

Dmorgan

Attempts:

3 left

💡 Hint

Common Mistakes

Importing 'express' instead of 'helmet'.

Forgetting to assign the require to a variable.

You import Helmet by requiring 'helmet' and assigning it to a variable, usually named helmet.

2fill in blank

medium

Complete the code to use Helmet middleware in the Express app.

Express

const app = express();
app.[1](helmet());

Drag options to blanks, or click blank then click option'

Ause

Blisten

Cget

Dpost

Attempts:

3 left

💡 Hint

Common Mistakes

Using app.listen instead of app.use.

Trying to use app.get or app.post for middleware.

To add middleware in Express, you use app.use(). Helmet is middleware, so you call app.use(helmet()).

3fill in blank

hard

Fix the error in the code to correctly set Helmet's contentSecurityPolicy option.

Express

app.use(helmet({ contentSecurityPolicy: [1] }));

Drag options to blanks, or click blank then click option'

A{}

Bfalse

C'default-src self'

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Passing a string instead of false.

Passing true which enables default policy.

To disable the contentSecurityPolicy in Helmet, you set contentSecurityPolicy: false. Using true or a string causes errors.

4fill in blank

hard

Fill both blanks to configure Helmet to disable frameguard and enable hsts with maxAge 1 year.

Express

app.use(helmet({ frameguard: [1], hsts: { maxAge: [2] } }));

Drag options to blanks, or click blank then click option'

Afalse

Btrue

C31536000

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Using true to disable frameguard.

Setting maxAge to 0 which disables hsts.

Setting frameguard to false disables it. The hsts maxAge is in seconds; 1 year is 31536000 seconds.

5fill in blank

hard

Fill all three blanks to create a Helmet config that disables dnsPrefetchControl, enables referrerPolicy with 'no-referrer', and sets crossOriginEmbedderPolicy to true.

Express

app.use(helmet({ dnsPrefetchControl: [1], referrerPolicy: { policy: '[2]' }, crossOriginEmbedderPolicy: [3] }));

Drag options to blanks, or click blank then click option'

Afalse

Bno-referrer

Ctrue

Dstrict-origin

Attempts:

3 left

💡 Hint

Common Mistakes

Using true to disable dnsPrefetchControl.

Using wrong string for referrerPolicy.

Setting crossOriginEmbedderPolicy to false.

To disable dnsPrefetchControl, set it to false. The referrerPolicy string 'no-referrer' disables sending referrer info. crossOriginEmbedderPolicy is a boolean, so true enables it.