Security Headers (by default via Helmet)

• dnsPrefetchControl: controls browser DNS prefetching
• frameguard: prevent clickjacking
• hidePoweredBy: remove the X-Powered-By header
• hsts: HTTP Strict Transport Security
• ieNoOpen: sets X-Download-Options for IE8+
• noSniff: keep clients from sniffing the MIME type
• xssFilter: adds some small XSS protections Additional security headers: https://helmetjs.github.io/docs/

Installation Instructions

npm install helmet --save

Express.js Middleware Stack Injection

import helmet  from 'helmet';
// Early on the middleware stack
this.app.use(helmet());