Helmet for security headers in Node.js - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import Helmet in a Node.js Express app.

Node.js

const express = require('express');
const helmet = require('[1]');
const app = express();

Drag options to blanks, or click blank then click option'

Abody-parser

Bhelmet

Ccors

Dexpress

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'express' instead of 'helmet' in the require statement.

Forgetting to import Helmet before using it.

The helmet package is imported by requiring 'helmet'. This allows you to use Helmet middleware in your Express app.

2fill in blank

medium

Complete the code to use Helmet middleware in the Express app.

Node.js

const express = require('express');
const helmet = require('helmet');
const app = express();

app.[1](helmet());

Drag options to blanks, or click blank then click option'

Ause

Blisten

Cget

Dpost

Attempts:

3 left

💡 Hint

Common Mistakes

Using app.listen() instead of app.use().

Trying to use app.get() or app.post() for middleware.

Use app.use() to add Helmet as middleware so it runs on every request.

3fill in blank

hard

Fix the error in the code to set a custom Content Security Policy with Helmet.

Node.js

const helmet = require('helmet');

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: [[1]],
  }
}));

Drag options to blanks, or click blank then click option'

A'none'

Bself

C'self'

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted self which causes syntax errors.

Using 'none' without quotes which is invalid.

The directive values must be strings with quotes, like 'self', to be valid in Helmet's Content Security Policy.

4fill in blank

hard

Fill both blanks to disable the Cross-Origin Embedder Policy and Cross-Origin Opener Policy in Helmet.

Node.js

app.use(helmet({
  crossOriginEmbedderPolicy: [1],
  crossOriginOpenerPolicy: [2]
}));

Drag options to blanks, or click blank then click option'

Afalse

Btrue

Cnull

Dundefined

Attempts:

3 left

💡 Hint

Common Mistakes

Using true instead of false enables the feature.

Using null or undefined does not disable the feature.

Setting these options to false disables those specific security policies in Helmet.

5fill in blank

hard

Fill all three blanks to create a Helmet middleware that sets a custom Referrer Policy and enables DNS Prefetch Control.

Node.js

app.use(helmet({
  referrerPolicy: { policy: '[1]' },
  dnsPrefetchControl: { allow: [2] },
  frameguard: { action: '[3]' }
}));

Drag options to blanks, or click blank then click option'

Ano-referrer

Btrue

Cdeny

Dorigin

Attempts:

3 left

💡 Hint

Common Mistakes

Using false for dnsPrefetchControl.allow disables it instead of enabling.

Using incorrect strings for referrerPolicy or frameguard action.

Setting referrerPolicy to 'no-referrer' hides referrer info. Setting dnsPrefetchControl allow to true enables it. Setting frameguard action to 'deny' blocks framing.