Careeroza

Helmet and CORS

Secure Headers with helmet

Example

npm i helmet

Example output

added 1 package in 1s

src/main.ts

import helmet from 'helmet';

const app = await NestFactory.create(AppModule);
app.use(helmet());                       // X-Content-Type-Options, Strict-Transport-Security, etc.
app.enableCors({
  origin: ['https://shopease.in', 'https://admin.shopease.in'],   // never "*" with credentials
  methods: ['GET', 'POST', 'PATCH', 'DELETE'],
  credentials: true,                     // allow cookies (refresh token)
  maxAge: 600,                           // cache preflight for 10 minutes
});

Example

curl -sI http://localhost:3000/products

Example output

HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;...
Cross-Origin-Opener-Policy: same-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Type: application/json; charset=utf-8

Security Checklist

  • Validate every input (ValidationPipe with whitelist).
  • Parameterised queries only (ORMs do this; careful with raw SQL).
  • Hash passwords (bcrypt/argon2); never log tokens or passwords.
  • Check ownership on every resource (IDOR).
  • Secrets in env / secret manager, never in git.
  • Limit body size: app.useBodyParser('json', { limit: '1mb' }).
  • Run npm audit and keep NestJS updated.