Enabling security via helmet module (#2)

* Enabling security via helmet module

Implementing security via helmet module by disabling sensitive headers,
taking care of CORS and XSS, enabling CSP and more.

Author: abame

package.json

@@ -12,10 +12,12 @@
     "dependencies": {
         "dotenv": "16.3.1",
         "express": "4.18.2",
+        "helmet": "7.0.0",
         "nunjucks": "3.2.4"
     },
     "devDependencies": {
         "@types/express": "4.17.17",
+        "@types/node": "20.3.3",
         "@types/nunjucks": "3.2.3",
         "eslint": "8.44.0",
         "nodemon": "2.0.22",

src/app.ts

@@ -1,14 +1,16 @@
 import dotenv from 'dotenv'
-
 import express from 'express'
 import nunjucks from 'nunjucks'
+import helmet from 'helmet'
 import routes from './routes'
 
 dotenv.config()
 
 const port = process.env.PORT ?? 3000
 const app = express()
 
+app.use(helmet())
+
 nunjucks.configure('src/views', {
   autoescape: true,
   express: app

yarn.lock

@@ -174,7 +174,7 @@
   resolved "https://registry.yarnpkg.com/@types/mime/-/mime-1.3.2.tgz#93e25bf9ee75fe0fd80b594bc4feb0e862111b5a"
   integrity sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==
 
-"@types/node@*":
+"@types/node@*", "@types/node@20.3.3":
   version "20.3.3"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-20.3.3.tgz#329842940042d2b280897150e023e604d11657d6"
   integrity sha512-wheIYdr4NYML61AjC8MKj/2jrR/kDQri/CIpVoZwldwhnIrD/j9jIU5bJ8yBKuB2VhpFV7Ab6G2XkBjv9r9Zzw==
@@ -484,7 +484,7 @@ doctrine@^3.0.0:
   dependencies:
     esutils "^2.0.2"
 
-dotenv@^16.3.1:
+dotenv@16.3.1:
   version "16.3.1"
   resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-16.3.1.tgz#369034de7d7e5b120972693352a3bf112172cc3e"
   integrity sha512-IPzF4w4/Rd94bA9imS68tZBaYyBWSCE47V1RGuMrB94iyTOIEwRmVL2x/4An+6mETpLrKJ5hQkB8W4kFAadeIQ==
@@ -812,6 +812,11 @@ has@^1.0.3:
   dependencies:
     function-bind "^1.1.1"
 
+helmet@7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/helmet/-/helmet-7.0.0.tgz#ac3011ba82fa2467f58075afa58a49427ba6212d"
+  integrity sha512-MsIgYmdBh460ZZ8cJC81q4XJknjG567wzEmv46WOBblDb6TUd3z8/GhgmsM9pn8g2B80tAJ4m5/d3Bi1KrSUBQ==
+
 http-errors@2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-2.0.0.tgz#b7774a1486ef73cf7667ac9ae0858c012c57b9d3"