Third-party middleware (cors, helmet) in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the CORS middleware in a NestJS application.

NestJS

import [1] from 'cors';

Drag options to blanks, or click blank then click option'

Acors

Bhelmet

Cexpress

DbodyParser

Attempts:

3 left

💡 Hint

Common Mistakes

Importing helmet instead of cors

Importing express instead of cors

Forgetting to import any middleware

The cors package is imported to enable Cross-Origin Resource Sharing middleware.

2fill in blank

medium

Complete the code to apply Helmet middleware globally in the NestJS app.

NestJS

app.use([1]());

Drag options to blanks, or click blank then click option'

Acors

BbodyParser

Cexpress.json

Dhelmet

Attempts:

3 left

💡 Hint

Common Mistakes

Using cors() instead of helmet()

Forgetting the parentheses after the middleware name

Using bodyParser instead of helmet

Helmet is used to secure HTTP headers and is applied as middleware with app.use(helmet()).

3fill in blank

hard

Fix the error in enabling CORS with options in the NestJS app.

NestJS

app.enableCors({ origin: [1] });

Drag options to blanks, or click blank then click option'

A'*'

Btrue

Cfalse

Dnull

Attempts:

3 left

💡 Hint

Common Mistakes

Using boolean true or false instead of a string

Using null which disables CORS

Leaving origin undefined

Setting origin: '*' allows all origins for CORS.

4fill in blank

hard

Fill both blanks to import and apply Helmet middleware in main.ts.

NestJS

import [1] from 'helmet';

app.use([2]());

Drag options to blanks, or click blank then click option'

Ahelmet

Bcors

Dexpress

Attempts:

3 left

💡 Hint

Common Mistakes

Importing cors instead of helmet

Using different names for import and usage

Forgetting parentheses when applying middleware

You import helmet and then apply it with app.use(helmet()).

5fill in blank

hard

Fill all three blanks to enable CORS with specific origin and apply Helmet middleware.

NestJS

app.enableCors({ origin: [1] });
app.use([2]());
app.use([3]());

Drag options to blanks, or click blank then click option'

A'https://example.com'

Bhelmet

Ccors

Dexpress

Attempts:

3 left

💡 Hint

Common Mistakes

Using '*' instead of a specific origin

Mixing up helmet and cors in usage order

Forgetting parentheses after middleware names

Enable CORS for https://example.com, then apply Helmet and CORS middleware.

Practice

1. What is the main purpose of using cors middleware in a NestJS application?

easy

A. To add security headers to HTTP responses

B. To control which websites can access your API

C. To log all incoming requests

D. To compress response data for faster delivery

Solution

1. Step 1: Understand the role of CORS

   CORS (Cross-Origin Resource Sharing) middleware controls which external websites or domains can access your API resources.

2. Step 2: Differentiate from other middleware

   Helmet adds security headers, logging middleware logs requests, and compression middleware compresses data. Only CORS controls access from other origins.

3. Final Answer:

   To control which websites can access your API -> Option B

4. Quick Check:

   CORS controls access = B [OK]

Hint: Remember CORS controls cross-site access permissions [OK]

Common Mistakes:

• Confusing CORS with Helmet's security headers
• Thinking CORS logs requests
• Assuming CORS compresses data

2. Which of the following is the correct way to apply Helmet middleware in a NestJS app?

easy

A. app.apply(helmet)

B. app.helmet()

C. app.use(helmet())

D. app.useHelmet()

Solution

1. Step 1: Recall NestJS middleware usage

   In NestJS, third-party middleware like Helmet is applied using app.use() with the middleware function called.

2. Step 2: Check syntax correctness

   The correct syntax is app.use(helmet()). Other options are not valid NestJS methods or miss calling the function.

3. Final Answer:

   app.use(helmet()) -> Option C

4. Quick Check:

   Use app.use() with middleware function call = A [OK]

Hint: Use app.use() with middleware function call [OK]

Common Mistakes:

• Forgetting to call helmet as a function
• Using non-existent app methods like app.helmet()
• Passing helmet without parentheses

3. Given this NestJS setup code, what will be the effect of the middleware?

import * as helmet from 'helmet';
import * as cors from 'cors';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cors({ origin: 'https://example.com' }));
  app.use(helmet());
  await app.listen(3000);
}

medium

A. Only requests from https://example.com are allowed, and security headers are added

B. All requests are allowed, but no security headers are added

C. Requests from any origin are blocked, and no headers are added

D. Requests from https://example.com are blocked, but security headers are added

Solution

1. Step 1: Analyze CORS middleware configuration

   The CORS middleware is configured to allow only requests from 'https://example.com'. Requests from other origins will be blocked.

2. Step 2: Analyze Helmet middleware effect

   Helmet adds security headers to all responses to improve security.

3. Final Answer:

   Only requests from https://example.com are allowed, and security headers are added -> Option A

4. Quick Check:

   CORS origin restrict + Helmet headers = C [OK]

Hint: Check CORS origin and Helmet adds headers [OK]

Common Mistakes:

• Assuming all origins are allowed
• Thinking Helmet blocks requests
• Confusing CORS blocking with allowing

4. Identify the error in this NestJS middleware setup:

import * as cors from 'cors';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(cors);
  await app.listen(3000);
}

medium

A. Missing await before app.use(cors)

B. cors should be imported from '@nestjs/cors' instead

C. app.use() cannot be used for middleware

D. Missing parentheses to call cors function

Solution

1. Step 1: Check how cors is used

   The code passes cors directly without calling it as a function. Middleware functions must be called to return the actual middleware.

2. Step 2: Confirm correct usage

   The correct usage is app.use(cors()). Other options are incorrect because NestJS supports app.use(), and no await is needed for middleware.

3. Final Answer:

   Missing parentheses to call cors function -> Option D

4. Quick Check:

   Middleware must be called as function = A [OK]

Hint: Always call middleware functions with () in app.use() [OK]

Common Mistakes:

• Passing middleware reference without calling it
• Confusing import sources for cors
• Trying to await app.use()

5. You want to secure your NestJS API by allowing only requests from https://myapp.com and add security headers. Which code snippet correctly applies both cors and helmet middleware with these requirements?

hard

A. app.use(cors({ origin: 'https://myapp.com' })); app.use(helmet());

B. app.use(helmet()); app.use(cors());

C. app.use(cors()); app.use(helmet({ origin: 'https://myapp.com' }));

D. app.use(cors({ origin: '*' })); app.use(helmet());

Solution

1. Step 1: Configure CORS with specific origin

   To allow only 'https://myapp.com', pass { origin: 'https://myapp.com' } to cors middleware.

2. Step 2: Apply Helmet middleware correctly

   Helmet is applied with helmet() to add security headers. It does not take origin options.

3. Step 3: Verify order and correctness

   Applying CORS first with correct origin, then Helmet, matches the requirements. Other options either miss origin restriction or misuse Helmet options.

4. Final Answer:

   app.use(cors({ origin: 'https://myapp.com' })); app.use(helmet()); -> Option A

5. Quick Check:

   CORS origin set + Helmet default = D [OK]

Hint: Set origin in cors, call helmet() without options [OK]

Common Mistakes:

• Passing origin option to helmet instead of cors
• Allowing all origins with '*'
• Reversing middleware order causing unexpected behavior