Helmet & Security Headers
Helmet EK middleware collection hai jo important security-related HTTP headers set karta hai: X-Content-Type-Options, Strict-Transport-Security, X-Frame-Options (clickjacking se bachaav), aur Content-Security-Policy.
Ye bhi zaroori hai ki "X-Powered-By: Express" header hata diya jaaye — wo attacker ko framework bata deta hai. Helmet ye khud kar deta hai, ya app.disable("x-powered-by") se manually.
const helmet = require("helmet");
app.use(helmet());
app.use(helmet.contentSecurityPolicy({
directives: { defaultSrc: ["'self'"], scriptSrc: ["'self'"] },
}));
app.disable("x-powered-by");- Helmet ek saath kai security headers set kar deta hai
- X-Powered-By hata do — framework batana attacker ki madad hai
- CSP powerful hai lekin pehle report-only mode mein test karo
helmet() default se kai headers set karta hai: Content-Security-Policy (kaunse resources load ho sakte hain), Strict-Transport-Security (hamesha HTTPS), X-Content-Type-Options: nosniff (MIME sniffing band), X-Frame-Options (clickjacking rok), aur Referrer-Policy. Ye sab ek line se aa jaate hain.
app.use(helmet());
// zaroorat par individual control
app.use(helmet({ contentSecurityPolicy: false }));Content-Security-Policy sabse powerful lekin sabse tricky header hai — strict policy inline scripts aur external CDNs block kar deti hai, jisse purani site turant tut sakti hai. Isliye pehle reportOnly: true rakho, browser reports dekho, exceptions tay karo, phir enforce karo.
app.use(helmet.contentSecurityPolicy({
reportOnly: true, // pehle sirf report
directives: {
defaultSrc: ["'self'"],
imgSrc: ["'self'", "data:", "https://cdn.code10x.in"],
},
}));