All language subtitles for 021 Setting Security HTTP Headers_Downloadly.ir_en

So, in this video,

we're gonna use yet another NPM package

in order to set a couple of

really important security http headers.

So, to set these headers

we will yet again use a middleware function

which will come again from an NPM package.

So, let's install that

and it's called helmet.

So this is kind of a standard in express development

so everyone who's building an express app

should always use this helmet package, all right.

Because again, express doesn't use

all the security best practices out of the box.

And so we basically need to manually go ahead

and put them there, okay.

So, const, helmet,

require,

helmet.

Okay and so let's do this right after this one,

and this one couldn't be any easier

all we need to do is call helmet here

and so that will then produce the middleware function

that should be put right here, okay.

So in app.use,

we always need a function, not a function call, right?

So here we are calling this function

and this will then in turn return a function

that's gonna be sitting here until it's called, all right.

And it's best to use this helmet package

early in the middleware stack

so that these headers are really sure to be set, okay.

So don't put it like somewhere at the end

put it right in the beginning

and actually let's put it really here in the beginning

as the first of all middlewares, okay.

And we are really growing our middleware stack here

let's just give each of them a name.

So, security, HTP,

headers.

That of course, not correct.

and too let's actually use a VRP.

Set security HTP,

limit requests

from same API.

Now we here we have this one as well.

So this is development logging basically.

Then this one here is called the body parser.

So basically reading

data from the body into req.body.

Okay.

And actually, since we're here,

let's implement that thing that I mentioned

in the theory lecture

where I said that we can limit the amount of data

that comes in the body.

Remember that?

So, here in json, we can actually specify

some options and for that as always

we pass an object.

And so we here can say,

limit and let's limit it to 10 kilobyte, okay.

And so the package will then understand

it will parse this string here

into a meaningful data, all right?

And so now when we have a body larger than 10 kilobyte

it will basically not be accepted, all right?

Then finally, this one here

is for serving

static files, okay.

And this is finally just like, some test middleware here.

Let's just keep it here because sometimes it's useful.

For example, for taking a look at the headers here

like we did back then.

Okay, so that is helmet.

Let's now do a request

and then take a look at all the headers

that it gives us basically.

So let's send it here

and then now you see we have 14 headers.

So that's a lot more than before

and so the new ones are basically this one here,

prefetch control off.

we have this strict transport security,

you have the download options,

there's also this one here for XSS protection

and so the browser understands these headers

and can then act on them basically, all right.

Let's quickly actually take a look

at the helmet documentation.

So of course as always

that's on GitHub.

And so here you see basically all the middlewares

that are included.

Because helmet is in fact

a collection of multiple middlewares.

So that's actually what is says here.

So it's a collection of 14 smaller middlewares

and some of them are active by default

which are these ones here

marked like this.

And so if you're interested,

you can take a look at all of these others

and then if you think you need some of them

you can of course then turn it on specifically.

and it tells you how to do that

also up here in the documentation, okay.

But I'm fine just with the default options

And so...

Now, that was actually very simple

and so let's now quickly move on to the next video.