Third-party middleware (cors, helmet) in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of enabling Helmet middleware in a NestJS app?

Consider a NestJS application where Helmet middleware is enabled globally. What does Helmet primarily do for your app?

NestJS

import helmet from 'helmet';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(helmet());
  await app.listen(3000);
}
bootstrap();

A It logs all incoming requests to the console for debugging.

B It adds security headers to HTTP responses to protect against common web vulnerabilities.

C It compresses HTTP responses to reduce bandwidth usage.

D It enables Cross-Origin Resource Sharing (CORS) for all domains by default.

💡 Hint

Think about what security headers do in web apps.

Helmet sets various HTTP headers that help protect your app from well-known web vulnerabilities like cross-site scripting, clickjacking, and others.

📝 Syntax

intermediate

Which code snippet correctly enables CORS with specific origin in NestJS?

You want to enable CORS only for the origin 'https://example.com' in your NestJS app. Which code snippet does this correctly?

A app.enableCors({ origin: 'https://example.com' });

B app.use(cors({ origin: 'https://example.com' }));

C app.enableCors('https://example.com');

D app.use(cors('https://example.com'));

💡 Hint

Check the NestJS method for enabling CORS with options.

In NestJS, enableCors is the built-in method to enable CORS with options. Passing an object with origin key sets allowed origins.

🔧 Debug

advanced

Why does this NestJS app fail to apply Helmet middleware correctly?

Review the code below. The app does not seem to have Helmet security headers applied. What is the cause?

NestJS

import helmet from 'helmet';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(helmet);
  await app.listen(3000);
}
bootstrap();

A The app.listen call must come before app.use to apply middleware.

B Helmet must be imported from '@nestjs/helmet' instead of 'helmet'.

C Helmet is passed as a function reference instead of being called, so middleware is not applied.

D Helmet middleware requires async/await when used with app.use.

💡 Hint

Check how middleware functions are passed in Express-based frameworks.

Helmet is a function that returns middleware. You must call it (helmet()) to get the middleware function. Passing helmet without parentheses passes the function itself, not the middleware.

❓ state_output

advanced

What headers are present after enabling Helmet in NestJS?

After enabling Helmet middleware with default settings in a NestJS app, which HTTP header will NOT be present in the response?

NestJS

app.use(helmet());

A X-Content-Type-Options

B X-DNS-Prefetch-Control

C X-Frame-Options

D Access-Control-Allow-Origin

💡 Hint

Helmet sets security headers, but CORS headers come from a different middleware.

Helmet sets security-related headers like X-Content-Type-Options, X-DNS-Prefetch-Control, and X-Frame-Options. The Access-Control-Allow-Origin header is set by CORS middleware, not Helmet.

🧠 Conceptual

expert

How do CORS and Helmet middleware complement each other in NestJS?

In a NestJS app, both CORS and Helmet middleware are enabled. What best describes how they work together?

A CORS controls which external domains can access resources; Helmet adds security headers to protect the app from attacks.

B Both CORS and Helmet handle cross-origin requests but Helmet also compresses responses.

C Helmet replaces CORS functionality by adding headers that allow all origins by default.

D CORS middleware encrypts requests; Helmet middleware decrypts them.

💡 Hint

Think about the purpose of CORS and security headers separately.

CORS middleware controls which external domains can access your app's resources by setting Access-Control-Allow-Origin and related headers. Helmet adds various security headers to protect against attacks like clickjacking and XSS. They serve different but complementary roles.