Grokking ExpressJS
Vote

0% completed

​

Securing APIs with Helmet, CORS, and Rate Limiting

Which headers does an Express response carry before you add any security middleware? Here is the full response of a fresh Express 5 app to GET /api/books:

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: application/json; charset=utf-8
Content-Length: 24
ETag: W/"18-Vc3zY/48nbsVv0DBWgelfJM77lQ"
Date: ...
Connection: close

The only security-related header is one that helps attackers: X-Powered-By: Express tells everyone which framework to target

.....

.....

.....

Like the course? Get enrolled and start learning!

Reading Progress

0%

Vote for new content