Hands-On Full-Stack Web Development with GraphQL and React

Express Helmet

Helmet is a tool that allows you to set various HTTP headers to secure your application.

We can enable the Express.js Helmet middleware as follows in the server index.js file:

app.use(helmet());app.use(helmet.contentSecurityPolicy({  directives: {    defaultSrc: ["'self'"],    scriptSrc: ["'self'", "'unsafe-inline'"],    styleSrc: ["'self'", "'unsafe-inline'"],    imgSrc: ["'self'", "data:", "*.amazonaws.com"]  }}));app.use(helmet.referrerPolicy({ policy: 'same-origin' }));

We are doing multiple things here at once. We add some XSS(Cross-Site-Scripting) protection tactics and remove the X-Powered-By HTTP header and some other useful things just by using the helmet() function in the first line.

You can look up the default parameters, as well ...