Compression and security headers in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the effect of applying compression middleware in a NestJS app?

Consider a NestJS application where compression middleware is enabled. What will be the visible effect on the HTTP responses sent to clients?

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as compression from 'compression';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(compression());
  await app.listen(3000);
}
bootstrap();

A HTTP responses will be automatically compressed (e.g., gzip) to reduce size before sending to clients.

B HTTP responses will be cached on the server to improve performance.

C HTTP responses will include security headers like Content-Security-Policy automatically.

D HTTP responses will be encrypted with TLS before sending to clients.

💡 Hint

Think about what compression middleware does to the data sent over the network.

Compression middleware compresses the HTTP response body (e.g., using gzip) to reduce the size of data sent to clients, improving load times and bandwidth usage.

📝 Syntax

intermediate

Which option correctly adds Helmet security headers in a NestJS app?

Given the following code snippet, which option correctly applies Helmet middleware to add security headers?

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as helmet from 'helmet';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  // Apply helmet middleware here
  await app.listen(3000);
}
bootstrap();

A app.helmet();

B app.useHelmet();

C app.use(helmet);

D app.use(helmet());

💡 Hint

Remember how to apply middleware functions in Express-based NestJS apps.

Helmet is a middleware function. To apply it, you call app.use(helmet()). Other options are invalid method calls or missing parentheses.

🔧 Debug

advanced

Why does this NestJS app fail to compress responses?

Review the code below. The developer expects responses to be compressed but they are not. What is the cause?

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as compression from 'compression';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(compression);
  await app.listen(3000);
}
bootstrap();

A The compression middleware is passed without calling it as a function, so it is not applied.

B Compression middleware must be imported from '@nestjs/compression' instead of 'compression'.

C The app.listen call must come before applying middleware.

D Compression middleware only works with HTTPS, so it fails on HTTP.

💡 Hint

Check how middleware functions are passed to app.use.

Middleware like compression must be called as a function to return the middleware handler. Passing compression without parentheses means the middleware is not applied.

❓ state_output

advanced

What security headers are added by default when using Helmet in NestJS?

After applying Helmet middleware with app.use(helmet()), which of the following headers will be present in HTTP responses by default?

NestJS

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
import * as helmet from 'helmet';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(helmet());
  await app.listen(3000);
}
bootstrap();

A Content-Encoding, Cache-Control, Access-Control-Allow-Origin, Content-Length

B X-DNS-Prefetch-Control, X-Frame-Options, Strict-Transport-Security, X-Download-Options, X-Content-Type-Options, Referrer-Policy

C Authorization, Cookie, Set-Cookie, WWW-Authenticate

D Content-Type, Content-Language, Content-Location, Content-MD5

💡 Hint

Think about common security headers that protect against clickjacking, sniffing, and other attacks.

Helmet sets several security headers by default, including X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, and others to improve security.

🧠 Conceptual

expert

Why is it important to combine compression and security headers in a NestJS app?

Choose the best explanation for why a NestJS app should use both compression middleware and security headers middleware like Helmet together.

A Compression middleware automatically adds security headers, so separate security middleware is unnecessary.

B Compression encrypts data for security, and security headers compress data for faster delivery; both do the same job redundantly.

C Compression reduces response size improving speed, while security headers protect users from attacks; together they enhance performance and safety.

D Security headers disable compression to avoid conflicts, so using both is not recommended.

💡 Hint

Think about the different roles compression and security headers play in web apps.

Compression improves performance by reducing data size. Security headers protect users from common web attacks. Using both ensures the app is fast and safe.