Helmet for security headers in Node.js - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Helmet in Node.js?

Helmet is a middleware for Express.js that helps secure your app by setting various HTTP headers to protect against common web vulnerabilities.

intermediate

Name two security headers that Helmet sets by default.

Helmet sets headers like X-Frame-Options to help protect against clickjacking, and X-DNS-Prefetch-Control to control DNS prefetching.

beginner

How do you add Helmet to an Express.js app?

You install Helmet with npm install helmet and then add it as middleware using app.use(helmet()) before your routes.

beginner

Why is setting security headers important in web apps?

Security headers help protect users by instructing browsers to block or limit risky behaviors, reducing risks like cross-site scripting, clickjacking, and data sniffing.

intermediate

Can you customize Helmet's behavior? How?

Yes, Helmet allows you to enable, disable, or configure individual security headers by passing options to helmet() or using specific Helmet middleware functions.

What does Helmet primarily do in a Node.js app?

A Sets security-related HTTP headers

B Manages database connections

C Handles user authentication

D Serves static files

Helmet sets HTTP headers that improve security by protecting against common web vulnerabilities.

Which command installs Helmet in a Node.js project?

A npm install express

B npm install middleware

C npm install security

D npm install helmet

The correct package name is 'helmet', so you install it with 'npm install helmet'.

How do you apply Helmet middleware in an Express app?

A app.get(helmet())

B app.use(helmet())

C app.listen(helmet())

D app.post(helmet())

Middleware is added with app.use(), so you use app.use(helmet()) to apply Helmet.

Which of these is NOT a security header set by Helmet by default?

A X-XSS-Protection

B X-DNS-Prefetch-Control

C X-Powered-By

D Strict-Transport-Security

Helmet removes or hides the 'X-Powered-By' header rather than setting it.

Why might you customize Helmet's settings?

A To adjust security headers for your app's needs

B To add database support

C To change the app's port

D To enable user sessions

Customizing Helmet lets you enable or disable specific headers to fit your app's security requirements.

Explain what Helmet does and why it is useful in a Node.js web application.

Think about how browsers can be told to behave more safely.

Describe how you would add Helmet to an Express app and customize one security header.

Focus on installation, usage, and configuration.

Practice

1. What is the main purpose of using helmet in a Node.js Express application?

easy

A. To serve static files like images and CSS

B. To improve the app's database performance

C. To add security headers that protect the app from common web attacks

D. To handle user authentication and sessions

Solution

1. Step 1: Understand Helmet's role

   Helmet is a middleware that adds HTTP headers to improve security.

2. Step 2: Identify its main function

   It protects against attacks like cross-site scripting by setting headers.

3. Final Answer:

   To add security headers that protect the app from common web attacks -> Option C

4. Quick Check:

   Helmet = Security headers [OK]

Hint: Helmet adds security headers, not database or auth [OK]

Common Mistakes:

• Thinking Helmet manages authentication
• Confusing Helmet with static file serving
• Assuming Helmet improves database speed

2. Which of the following is the correct way to use Helmet in an Express app?

easy

A. import helmet from 'helmet'; app.use(helmet());

B. import helmet from 'helmet'; app.use(helmet);

C. const helmet = require('helmet'); app.use(helmet);

D. const helmet = require('helmet'); app.use(helmet());

Solution

1. Step 1: Check import syntax for modern Node.js

   Using ES modules, import helmet from 'helmet' is correct, but in CommonJS require syntax is used differently.

2. Step 2: Use helmet as middleware function

   Helmet must be called as a function: helmet() inside app.use().

3. Final Answer:

   const helmet = require('helmet'); app.use(helmet()); -> Option D

4. Quick Check:

   Require + call helmet() = correct usage [OK]

Hint: Remember to call helmet() when using app.use [OK]

Common Mistakes:

• Forgetting to call helmet() as a function
• Using require without calling helmet()
• Mixing import and require syntax incorrectly

3. Given this Express app code snippet, what HTTP header will Helmet add by default?

import express from 'express';
import helmet from 'helmet';
const app = express();
app.use(helmet());
app.get('/', (req, res) => res.send('Hello'));
app.listen(3000);

medium

A. Content-Security-Policy

B. X-DNS-Prefetch-Control

C. X-Powered-By

D. Strict-Transport-Security

Solution

1. Step 1: Recall Helmet default headers

   Helmet disables 'X-Powered-By' and adds several security headers by default.

2. Step 2: Identify which header Helmet sets by default

   Among options, 'X-DNS-Prefetch-Control' is one of the default headers Helmet adds.

3. Final Answer:

   X-DNS-Prefetch-Control -> Option B

4. Quick Check:

   Helmet default header = X-DNS-Prefetch-Control [OK]

Hint: Helmet adds X-DNS-Prefetch-Control by default [OK]

Common Mistakes:

• Assuming Content-Security-Policy is always set by default
• Thinking X-Powered-By header is added instead of removed
• Confusing Strict-Transport-Security which needs HTTPS setup

4. What is wrong with this Helmet usage in an Express app?

import helmet from 'helmet';
app.use(helmet);

medium

A. Helmet middleware is not called as a function

B. Helmet is not imported correctly

C. Helmet should be used after route definitions

D. Helmet requires additional configuration to work

Solution

1. Step 1: Check how helmet is used in app.use

   Helmet must be called as a function: helmet() not just helmet.

2. Step 2: Identify the error in middleware usage

   Using app.use(helmet) passes the function itself, not the middleware it returns.

3. Final Answer:

   Helmet middleware is not called as a function -> Option A

4. Quick Check:

   Call helmet() to use middleware [OK]

Hint: Always call helmet() in app.use [OK]

Common Mistakes:

• Passing helmet without parentheses
• Importing helmet incorrectly
• Placing helmet after routes (should be before)

5. You want to disable the contentSecurityPolicy header in Helmet but keep all other default headers. Which code snippet correctly does this?

hard

A. app.use(helmet({ contentSecurityPolicy: false }));

B. app.use(helmet.contentSecurityPolicy(false));

C. app.use(helmet.disable('contentSecurityPolicy'));

D. app.use(helmet({ disable: ['contentSecurityPolicy'] }));

Solution

1. Step 1: Understand Helmet configuration object

   Helmet accepts an options object where you can disable specific headers by setting them to false.

2. Step 2: Identify correct syntax to disable contentSecurityPolicy

   Setting contentSecurityPolicy: false inside helmet() disables only that header.

3. Final Answer:

   app.use(helmet({ contentSecurityPolicy: false })); -> Option A

4. Quick Check:

   Disable header by setting false in options [OK]

Hint: Use helmet({ contentSecurityPolicy: false }) to disable it [OK]

Common Mistakes:

• Trying to call helmet.contentSecurityPolicy as a function
• Using non-existent disable method
• Passing disable array instead of options object