Security headers for an Express app

Javascript

The handful worth setting even when you are not using a framework that sets them for you.

app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  next();
});

Download

Security express headers web chris

More in Security

Compare secrets in constant time Security A plain === leaks how much of the token matched through its timing. This does not. A starting Content-Security-Policy Security Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing. Generate a strong random secret Security For session keys and tokens. Never reach for a password generator or a UUID for this. Check a file's checksum Security Verifies a download actually matches what the publisher signed, rather than trusting the transfer. Generate an SSH key and add it to the agent Security Ed25519 rather than RSA: shorter, faster, and no key-size decision to get wrong.

Random picks

Watch a command until it succeeds Shell Retries every two seconds and stops the moment the command exits zero. Useful while waiting for a service to come up. Replace text across a whole project Text Processing ripgrep finds the files, sed edits them in place. The dry run first is not optional. Rewrite a CSV column with perl Text Processing A one-liner that upper-cases the second field of every row, leaving the rest alone. Result and the question mark operator in Rust Systems ? propagates the error to the caller, which is why Rust functions rarely need explicit error branches. Find the largest files with PowerShell Shell The Windows counterpart to du | sort | head. Deep clone a value JavaScript structuredClone handles Dates, Maps, Sets and cycles, which JSON round-tripping quietly destroys. RAII file handling in C++ Systems The stream closes itself when it leaves scope, whether the function returns normally or throws. Table-driven tests in Go Testing The idiomatic Go pattern: a slice of cases and a subtest per entry, each named so failures are readable.