Third-party middleware (cors, helmet) in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of enabling Helmet middleware in a NestJS app?

Consider a NestJS application where Helmet middleware is enabled globally. What does Helmet primarily do for your app?

NestJS

import helmet from 'helmet';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(helmet());
  await app.listen(3000);
}
bootstrap();

A It logs all incoming requests to the console for debugging.

B It adds security headers to HTTP responses to protect against common web vulnerabilities.

C It compresses HTTP responses to reduce bandwidth usage.

D It enables Cross-Origin Resource Sharing (CORS) for all domains by default.

💡 Hint

Think about what security headers do in web apps.

Helmet sets various HTTP headers that help protect your app from well-known web vulnerabilities like cross-site scripting, clickjacking, and others.

📝 Syntax

intermediate

Which code snippet correctly enables CORS with specific origin in NestJS?

You want to enable CORS only for the origin 'https://example.com' in your NestJS app. Which code snippet does this correctly?

A app.enableCors({ origin: 'https://example.com' });

B app.use(cors({ origin: 'https://example.com' }));

C app.enableCors('https://example.com');

D app.use(cors('https://example.com'));

💡 Hint

Check the NestJS method for enabling CORS with options.

In NestJS, enableCors is the built-in method to enable CORS with options. Passing an object with origin key sets allowed origins.

🔧 Debug

advanced

Why does this NestJS app fail to apply Helmet middleware correctly?

Review the code below. The app does not seem to have Helmet security headers applied. What is the cause?

NestJS

import helmet from 'helmet';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(helmet);
  await app.listen(3000);
}
bootstrap();

A The app.listen call must come before app.use to apply middleware.

B Helmet must be imported from '@nestjs/helmet' instead of 'helmet'.

C Helmet is passed as a function reference instead of being called, so middleware is not applied.

D Helmet middleware requires async/await when used with app.use.

💡 Hint

Check how middleware functions are passed in Express-based frameworks.

Helmet is a function that returns middleware. You must call it (helmet()) to get the middleware function. Passing helmet without parentheses passes the function itself, not the middleware.

❓ state_output

advanced

What headers are present after enabling Helmet in NestJS?

After enabling Helmet middleware with default settings in a NestJS app, which HTTP header will NOT be present in the response?

NestJS

app.use(helmet());

A X-Content-Type-Options

B X-DNS-Prefetch-Control

C X-Frame-Options

D Access-Control-Allow-Origin

💡 Hint

Helmet sets security headers, but CORS headers come from a different middleware.

Helmet sets security-related headers like X-Content-Type-Options, X-DNS-Prefetch-Control, and X-Frame-Options. The Access-Control-Allow-Origin header is set by CORS middleware, not Helmet.

🧠 Conceptual

expert

How do CORS and Helmet middleware complement each other in NestJS?

In a NestJS app, both CORS and Helmet middleware are enabled. What best describes how they work together?

A CORS controls which external domains can access resources; Helmet adds security headers to protect the app from attacks.

B Both CORS and Helmet handle cross-origin requests but Helmet also compresses responses.

C Helmet replaces CORS functionality by adding headers that allow all origins by default.

D CORS middleware encrypts requests; Helmet middleware decrypts them.

💡 Hint

Think about the purpose of CORS and security headers separately.

CORS middleware controls which external domains can access your app's resources by setting Access-Control-Allow-Origin and related headers. Helmet adds various security headers to protect against attacks like clickjacking and XSS. They serve different but complementary roles.

Practice

1. What is the main purpose of using cors middleware in a NestJS application?

easy

A. To add security headers to HTTP responses

B. To control which websites can access your API

C. To log all incoming requests

D. To compress response data for faster delivery

Solution

1. Step 1: Understand the role of CORS

   CORS (Cross-Origin Resource Sharing) middleware controls which external websites or domains can access your API resources.

2. Step 2: Differentiate from other middleware

   Helmet adds security headers, logging middleware logs requests, and compression middleware compresses data. Only CORS controls access from other origins.

3. Final Answer:

   To control which websites can access your API -> Option B

4. Quick Check:

   CORS controls access = B [OK]

Hint: Remember CORS controls cross-site access permissions [OK]

Common Mistakes:

• Confusing CORS with Helmet's security headers
• Thinking CORS logs requests
• Assuming CORS compresses data

2. Which of the following is the correct way to apply Helmet middleware in a NestJS app?

easy

A. app.apply(helmet)

B. app.helmet()

C. app.use(helmet())

D. app.useHelmet()

Solution

1. Step 1: Recall NestJS middleware usage

   In NestJS, third-party middleware like Helmet is applied using app.use() with the middleware function called.

2. Step 2: Check syntax correctness

   The correct syntax is app.use(helmet()). Other options are not valid NestJS methods or miss calling the function.

3. Final Answer:

   app.use(helmet()) -> Option C

4. Quick Check:

   Use app.use() with middleware function call = A [OK]

Hint: Use app.use() with middleware function call [OK]

Common Mistakes:

• Forgetting to call helmet as a function
• Using non-existent app methods like app.helmet()
• Passing helmet without parentheses

3. Given this NestJS setup code, what will be the effect of the middleware?

import * as helmet from 'helmet';
import * as cors from 'cors';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cors({ origin: 'https://example.com' }));
  app.use(helmet());
  await app.listen(3000);
}

medium

A. Only requests from https://example.com are allowed, and security headers are added

B. All requests are allowed, but no security headers are added

C. Requests from any origin are blocked, and no headers are added

D. Requests from https://example.com are blocked, but security headers are added

Solution

1. Step 1: Analyze CORS middleware configuration

   The CORS middleware is configured to allow only requests from 'https://example.com'. Requests from other origins will be blocked.

2. Step 2: Analyze Helmet middleware effect

   Helmet adds security headers to all responses to improve security.

3. Final Answer:

   Only requests from https://example.com are allowed, and security headers are added -> Option A

4. Quick Check:

   CORS origin restrict + Helmet headers = C [OK]

Hint: Check CORS origin and Helmet adds headers [OK]

Common Mistakes:

• Assuming all origins are allowed
• Thinking Helmet blocks requests
• Confusing CORS blocking with allowing

4. Identify the error in this NestJS middleware setup:

import * as cors from 'cors';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cors);
  await app.listen(3000);
}

medium

A. Missing await before app.use(cors)

B. cors should be imported from '@nestjs/cors' instead

C. app.use() cannot be used for middleware

D. Missing parentheses to call cors function

Solution

1. Step 1: Check how cors is used

   The code passes cors directly without calling it as a function. Middleware functions must be called to return the actual middleware.

2. Step 2: Confirm correct usage

   The correct usage is app.use(cors()). Other options are incorrect because NestJS supports app.use(), and no await is needed for middleware.

3. Final Answer:

   Missing parentheses to call cors function -> Option D

4. Quick Check:

   Middleware must be called as function = A [OK]

Hint: Always call middleware functions with () in app.use() [OK]

Common Mistakes:

• Passing middleware reference without calling it
• Confusing import sources for cors
• Trying to await app.use()

5. You want to secure your NestJS API by allowing only requests from https://myapp.com and add security headers. Which code snippet correctly applies both cors and helmet middleware with these requirements?

hard

A. app.use(cors({ origin: 'https://myapp.com' })); app.use(helmet());

B. app.use(helmet()); app.use(cors());

C. app.use(cors()); app.use(helmet({ origin: 'https://myapp.com' }));

D. app.use(cors({ origin: '*' })); app.use(helmet());

Solution

1. Step 1: Configure CORS with specific origin

   To allow only 'https://myapp.com', pass { origin: 'https://myapp.com' } to cors middleware.

2. Step 2: Apply Helmet middleware correctly

   Helmet is applied with helmet() to add security headers. It does not take origin options.

3. Step 3: Verify order and correctness

   Applying CORS first with correct origin, then Helmet, matches the requirements. Other options either miss origin restriction or misuse Helmet options.

4. Final Answer:

   app.use(cors({ origin: 'https://myapp.com' })); app.use(helmet()); -> Option A

5. Quick Check:

   CORS origin set + Helmet default = D [OK]

Hint: Set origin in cors, call helmet() without options [OK]

Common Mistakes:

• Passing origin option to helmet instead of cors
• Allowing all origins with '*'
• Reversing middleware order causing unexpected behavior