Third-party middleware (cors, helmet) in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is middleware in NestJS?

Middleware in NestJS is a function that runs before the route handler. It can modify the request or response, or end the request-response cycle.

beginner

What does the CORS middleware do?

CORS middleware allows or restricts cross-origin requests from browsers, helping control which websites can access your API.

beginner

What is Helmet middleware used for in NestJS?

Helmet helps secure your app by setting various HTTP headers that protect against common web vulnerabilities.

beginner

How do you enable CORS in a NestJS application?

You enable CORS by calling app.enableCors() in the main.ts file before starting the app.

beginner

How do you apply Helmet middleware in NestJS?

You apply Helmet by importing it and calling app.use(helmet()) in the main.ts file before app.listen().

What is the main purpose of CORS middleware?

A To control cross-origin requests from browsers

B To compress HTTP responses

C To log incoming requests

D To serve static files

CORS middleware controls which external websites can access your API by managing cross-origin requests.

Which HTTP headers does Helmet help set?

A Security-related headers like Content-Security-Policy and X-Frame-Options

B Headers for caching only

C Headers for file uploads

D Headers for database connections

Helmet sets security headers such as Content-Security-Policy and X-Frame-Options to protect your app.

Where do you typically enable CORS in a NestJS app?

A In a controller method

B In a service class

C In the main.ts file before app.listen()

D In the package.json file

CORS is enabled in main.ts before starting the app to apply it globally.

How do you add Helmet middleware to a NestJS app?

A By configuring it in a service

B By importing Helmet in a controller

C By adding Helmet to package.json scripts

D By calling app.use(helmet()) in main.ts

Helmet middleware is added by calling app.use(helmet()) in main.ts before app.listen().

Which of these is NOT a benefit of using Helmet?

A Protecting against clickjacking

B Enabling cross-origin requests

C Setting Content Security Policy

D Preventing MIME type sniffing

Enabling cross-origin requests is handled by CORS, not Helmet.

Explain how to add and configure CORS middleware in a NestJS application.

Think about where the app starts and how browsers restrict requests.

Describe what Helmet middleware does and why it is important for NestJS apps.

Consider how websites protect themselves from hackers using headers.

Practice

1. What is the main purpose of using cors middleware in a NestJS application?

easy

A. To add security headers to HTTP responses

B. To control which websites can access your API

C. To log all incoming requests

D. To compress response data for faster delivery

Solution

1. Step 1: Understand the role of CORS

   CORS (Cross-Origin Resource Sharing) middleware controls which external websites or domains can access your API resources.

2. Step 2: Differentiate from other middleware

   Helmet adds security headers, logging middleware logs requests, and compression middleware compresses data. Only CORS controls access from other origins.

3. Final Answer:

   To control which websites can access your API -> Option B

4. Quick Check:

   CORS controls access = B [OK]

Hint: Remember CORS controls cross-site access permissions [OK]

Common Mistakes:

• Confusing CORS with Helmet's security headers
• Thinking CORS logs requests
• Assuming CORS compresses data

2. Which of the following is the correct way to apply Helmet middleware in a NestJS app?

easy

A. app.apply(helmet)

B. app.helmet()

C. app.use(helmet())

D. app.useHelmet()

Solution

1. Step 1: Recall NestJS middleware usage

   In NestJS, third-party middleware like Helmet is applied using app.use() with the middleware function called.

2. Step 2: Check syntax correctness

   The correct syntax is app.use(helmet()). Other options are not valid NestJS methods or miss calling the function.

3. Final Answer:

   app.use(helmet()) -> Option C

4. Quick Check:

   Use app.use() with middleware function call = A [OK]

Hint: Use app.use() with middleware function call [OK]

Common Mistakes:

• Forgetting to call helmet as a function
• Using non-existent app methods like app.helmet()
• Passing helmet without parentheses

3. Given this NestJS setup code, what will be the effect of the middleware?

import * as helmet from 'helmet';
import * as cors from 'cors';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cors({ origin: 'https://example.com' }));
  app.use(helmet());
  await app.listen(3000);
}

medium

A. Only requests from https://example.com are allowed, and security headers are added

B. All requests are allowed, but no security headers are added

C. Requests from any origin are blocked, and no headers are added

D. Requests from https://example.com are blocked, but security headers are added

Solution

1. Step 1: Analyze CORS middleware configuration

   The CORS middleware is configured to allow only requests from 'https://example.com'. Requests from other origins will be blocked.

2. Step 2: Analyze Helmet middleware effect

   Helmet adds security headers to all responses to improve security.

3. Final Answer:

   Only requests from https://example.com are allowed, and security headers are added -> Option A

4. Quick Check:

   CORS origin restrict + Helmet headers = C [OK]

Hint: Check CORS origin and Helmet adds headers [OK]

Common Mistakes:

• Assuming all origins are allowed
• Thinking Helmet blocks requests
• Confusing CORS blocking with allowing

4. Identify the error in this NestJS middleware setup:

import * as cors from 'cors';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cors);
  await app.listen(3000);
}

medium

A. Missing await before app.use(cors)

B. cors should be imported from '@nestjs/cors' instead

C. app.use() cannot be used for middleware

D. Missing parentheses to call cors function

Solution

1. Step 1: Check how cors is used

   The code passes cors directly without calling it as a function. Middleware functions must be called to return the actual middleware.

2. Step 2: Confirm correct usage

   The correct usage is app.use(cors()). Other options are incorrect because NestJS supports app.use(), and no await is needed for middleware.

3. Final Answer:

   Missing parentheses to call cors function -> Option D

4. Quick Check:

   Middleware must be called as function = A [OK]

Hint: Always call middleware functions with () in app.use() [OK]

Common Mistakes:

• Passing middleware reference without calling it
• Confusing import sources for cors
• Trying to await app.use()

5. You want to secure your NestJS API by allowing only requests from https://myapp.com and add security headers. Which code snippet correctly applies both cors and helmet middleware with these requirements?

hard

A. app.use(cors({ origin: 'https://myapp.com' })); app.use(helmet());

B. app.use(helmet()); app.use(cors());

C. app.use(cors()); app.use(helmet({ origin: 'https://myapp.com' }));

D. app.use(cors({ origin: '*' })); app.use(helmet());

Solution

1. Step 1: Configure CORS with specific origin

   To allow only 'https://myapp.com', pass { origin: 'https://myapp.com' } to cors middleware.

2. Step 2: Apply Helmet middleware correctly

   Helmet is applied with helmet() to add security headers. It does not take origin options.

3. Step 3: Verify order and correctness

   Applying CORS first with correct origin, then Helmet, matches the requirements. Other options either miss origin restriction or misuse Helmet options.

4. Final Answer:

   app.use(cors({ origin: 'https://myapp.com' })); app.use(helmet()); -> Option A

5. Quick Check:

   CORS origin set + Helmet default = D [OK]

Hint: Set origin in cors, call helmet() without options [OK]

Common Mistakes:

• Passing origin option to helmet instead of cors
• Allowing all origins with '*'
• Reversing middleware order causing unexpected behavior