Helmet for security headers in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What HTTP header does Helmet set by default to prevent clickjacking?

Helmet sets several security headers by default. Which header does it set to help prevent clickjacking attacks?

A X-Frame-Options

B X-Content-Type-Options

C Strict-Transport-Security

D Content-Security-Policy

💡 Hint

Think about which header controls if a page can be shown inside a frame or iframe.

The X-Frame-Options header tells browsers whether the page can be displayed inside frames or iframes, helping prevent clickjacking.

📝 Syntax

intermediate

Which code snippet correctly applies Helmet middleware in an Express app?

You want to add Helmet to your Express.js app to improve security headers. Which code snippet correctly applies Helmet middleware?

A helmet(app);

B app.helmet();

C app.use(helmet());

D app.use(helmet);

💡 Hint

Remember how middleware functions are added in Express.

In Express, middleware is added using app.use() and Helmet is a function that returns middleware, so app.use(helmet()) is correct.

🔧 Debug

advanced

Why does this Helmet configuration cause an error?

Consider this code snippet:

const helmet = require('helmet');
app.use(helmet.contentSecurityPolicy());

Why does this cause an error when running the app?

Node.js

const helmet = require('helmet');
app.use(helmet.contentSecurityPolicy());

A helmet must be imported with import syntax, not require

B helmet.contentSecurityPolicy requires options argument and fails without it

C app.use must be called after app.listen

D contentSecurityPolicy is not a direct method on helmet in the latest version

💡 Hint

Check the latest Helmet API for how to use contentSecurityPolicy.

In Helmet v5+, the individual middleware like contentSecurityPolicy is not exposed as a direct method on the helmet import. Instead, you import it separately or configure Helmet differently.

❓ state_output

advanced

What is the effect of disabling the 'crossOriginEmbedderPolicy' in Helmet?

Given this Helmet setup:

app.use(helmet({ crossOriginEmbedderPolicy: false }));

What effect does disabling 'crossOriginEmbedderPolicy' have on the HTTP headers sent?

Node.js

app.use(helmet({ crossOriginEmbedderPolicy: false }));

A The Cross-Origin-Embedder-Policy header will not be set

B The Cross-Origin-Embedder-Policy header will be set to 'unsafe-none'

C The Cross-Origin-Embedder-Policy header will be set to 'require-corp'

D Helmet will throw an error because crossOriginEmbedderPolicy cannot be false

💡 Hint

Disabling a Helmet option usually means it won't add that header.

Setting crossOriginEmbedderPolicy: false disables that middleware, so Helmet does not set the Cross-Origin-Embedder-Policy header at all.

🧠 Conceptual

expert

Why is Helmet important for modern web applications?

Which of the following best explains why using Helmet is important for modern web applications?

A Helmet automatically fixes all security bugs in your code

B Helmet sets HTTP headers that help protect against common web vulnerabilities by instructing browsers how to behave

C Helmet encrypts all data sent between client and server

D Helmet replaces the need for HTTPS by securing headers

💡 Hint

Think about what HTTP headers do and how browsers use them.

Helmet helps by setting security-related HTTP headers that tell browsers to block or restrict risky behaviors, reducing attack surface.

Practice

1. What is the main purpose of using helmet in a Node.js Express application?

easy

A. To serve static files like images and CSS

B. To improve the app's database performance

C. To add security headers that protect the app from common web attacks

D. To handle user authentication and sessions

Solution

1. Step 1: Understand Helmet's role

   Helmet is a middleware that adds HTTP headers to improve security.

2. Step 2: Identify its main function

   It protects against attacks like cross-site scripting by setting headers.

3. Final Answer:

   To add security headers that protect the app from common web attacks -> Option C

4. Quick Check:

   Helmet = Security headers [OK]

Hint: Helmet adds security headers, not database or auth [OK]

Common Mistakes:

• Thinking Helmet manages authentication
• Confusing Helmet with static file serving
• Assuming Helmet improves database speed

2. Which of the following is the correct way to use Helmet in an Express app?

easy

A. import helmet from 'helmet'; app.use(helmet());

B. import helmet from 'helmet'; app.use(helmet);

C. const helmet = require('helmet'); app.use(helmet);

D. const helmet = require('helmet'); app.use(helmet());

Solution

1. Step 1: Check import syntax for modern Node.js

   Using ES modules, import helmet from 'helmet' is correct, but in CommonJS require syntax is used differently.

2. Step 2: Use helmet as middleware function

   Helmet must be called as a function: helmet() inside app.use().

3. Final Answer:

   const helmet = require('helmet'); app.use(helmet()); -> Option D

4. Quick Check:

   Require + call helmet() = correct usage [OK]

Hint: Remember to call helmet() when using app.use [OK]

Common Mistakes:

• Forgetting to call helmet() as a function
• Using require without calling helmet()
• Mixing import and require syntax incorrectly

3. Given this Express app code snippet, what HTTP header will Helmet add by default?

import express from 'express';
import helmet from 'helmet';
const app = express();
app.use(helmet());
app.get('/', (req, res) => res.send('Hello'));
app.listen(3000);

medium

A. Content-Security-Policy

B. X-DNS-Prefetch-Control

C. X-Powered-By

D. Strict-Transport-Security

Solution

1. Step 1: Recall Helmet default headers

   Helmet disables 'X-Powered-By' and adds several security headers by default.

2. Step 2: Identify which header Helmet sets by default

   Among options, 'X-DNS-Prefetch-Control' is one of the default headers Helmet adds.

3. Final Answer:

   X-DNS-Prefetch-Control -> Option B

4. Quick Check:

   Helmet default header = X-DNS-Prefetch-Control [OK]

Hint: Helmet adds X-DNS-Prefetch-Control by default [OK]

Common Mistakes:

• Assuming Content-Security-Policy is always set by default
• Thinking X-Powered-By header is added instead of removed
• Confusing Strict-Transport-Security which needs HTTPS setup

4. What is wrong with this Helmet usage in an Express app?

import helmet from 'helmet';
app.use(helmet);

medium

A. Helmet middleware is not called as a function

B. Helmet is not imported correctly

C. Helmet should be used after route definitions

D. Helmet requires additional configuration to work

Solution

1. Step 1: Check how helmet is used in app.use

   Helmet must be called as a function: helmet() not just helmet.

2. Step 2: Identify the error in middleware usage

   Using app.use(helmet) passes the function itself, not the middleware it returns.

3. Final Answer:

   Helmet middleware is not called as a function -> Option A

4. Quick Check:

   Call helmet() to use middleware [OK]

Hint: Always call helmet() in app.use [OK]

Common Mistakes:

• Passing helmet without parentheses
• Importing helmet incorrectly
• Placing helmet after routes (should be before)

5. You want to disable the contentSecurityPolicy header in Helmet but keep all other default headers. Which code snippet correctly does this?

hard

A. app.use(helmet({ contentSecurityPolicy: false }));

B. app.use(helmet.contentSecurityPolicy(false));

C. app.use(helmet.disable('contentSecurityPolicy'));

D. app.use(helmet({ disable: ['contentSecurityPolicy'] }));

Solution

1. Step 1: Understand Helmet configuration object

   Helmet accepts an options object where you can disable specific headers by setting them to false.

2. Step 2: Identify correct syntax to disable contentSecurityPolicy

   Setting contentSecurityPolicy: false inside helmet() disables only that header.

3. Final Answer:

   app.use(helmet({ contentSecurityPolicy: false })); -> Option A

4. Quick Check:

   Disable header by setting false in options [OK]

Hint: Use helmet({ contentSecurityPolicy: false }) to disable it [OK]

Common Mistakes:

• Trying to call helmet.contentSecurityPolicy as a function
• Using non-existent disable method
• Passing disable array instead of options object