- [Narrator] Before we deploy our application
to the open world,
we should make sure that it fulfills
basic security requirements.
Express comes with a set of recommended best practices.
Many deal with how secure connections are handled,
but we will later use Nginx to do that for us.
Before we talk about Express as such you should make sure
that the dependencies we brought in are secure.
Newer versions of npm make this very easy for us.
We can simply run npm audit
and it will check all installed modules
for known vulnerabilities and we see that we have
1074 packages
installed right now.
But this is plenty of code and there is plenty
that could go wrong.
So running npm audit frequently like for every deployment
makes sense to make sure that there are no packages
installed that have known vulnerabilities
that can be explored.
An easy way to add some level of security to Express
is using Helmet.
Helmet combines a set of middlewares that deal
with non-attack vectors on websites.
If we look at the Helmet website
we see that the different measures are very well documented.
So if we look for instance at Hide Powered-By
we get a key explanation which attack is prevented
with this measure.
Please take your time to review and understand the different
attacks that Helmet can prevent.
We will now install Helmet into our application
for that I go into to Visual Studio code
and I simply add npm install helmet
and on top of our server.
App.js file.
Ubpringing Helmet
const helmet
equals require
helmet.
And further down after we instantiated the express
we will simply add the middleware app.use helmet
parentheses and let's start the application.
And back on the browser,
let's open from developer tools.
Let's reload the page and when we click on the request
for localhost we see that helmet set a few headers here
that deal with different kinds of attacks.
Later as mentioned we will add an additional level
of security by serving requests not directly from node.js
but via Ngenix as reverse proxy.