Hardening headers in web frameworks
Due to Node's "batteries not included" philosophy, which also influenced the philosophy of certain web frameworks (such as Express), security features tend to be a manual add-on or at least a matter of manual configuration.
In this recipe, we'll show how to harden an Express web server (along with hardening servers built with other frameworks in the There's more section).
Getting ready
We're going to use the official Express application generator because this definitively identifies the standard defaults of an Express project.
Let's install express-genenerator
and use it to create an Express project named app
:
$ npm install -g express-generator $ express app $ cp app $ npm install
Note
Web Frameworks
In this recipe, we're hardening Express, in the There's more section we harden various other frameworks. For a comprehensive introduction to Web Frameworks see Chapter 7, Working with Web Frameworks.
A final step getting ready, since this book is written using...