What is the Helmet package, and which essential security headers does it add to a Node.js application?

Short answer

It is middleware that adds standard security headers such as Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options, and hides the X-Powered-By header.

Explanation

Security headers help browsers isolate your site and prevent common vulnerabilities: Clickjacking (with X-Frame-Options: DENY), enforce encrypted connections (with HSTS), block untrusted scripts (with CSP), prevent browsers from guessing file types (with X-Content-Type-Options: nosniff), and hide the technology in use by removing X-Powered-By: Express.

Code example

import helmet from "helmet";
app.use(helmet());

Common mistakes

• Leaving the X-Powered-By: Express header visible to the public, making it easier for attackers to target vulnerabilities in your version.

Follow-up questions

• What is Cross-Origin Resource Sharing (CORS), and what are Preflight Requests?

Sources

• Helmet — documentation