‫So, in this video,
‫we're gonna use yet another NPM package
‫in order to set a couple of
‫really important security http headers.
‫So, to set these headers
‫we will yet again use a middleware function
‫which will come again from an NPM package.
‫So, let's install that
‫and it's called helmet.
‫So this is kind of a standard in express development
‫so everyone who's building an express app
‫should always use this helmet package, all right.
‫Because again, express doesn't use
‫all the security best practices out of the box.
‫And so we basically need to manually go ahead
‫and put them there, okay.
‫So, const, helmet,
‫require,
‫helmet.
‫Okay and so let's do this right after this one,
‫and this one couldn't be any easier
‫all we need to do is call helmet here
‫and so that will then produce the middleware function
‫that should be put right here, okay.
‫So in app.use,
‫we always need a function, not a function call, right?
‫So here we are calling this function
‫and this will then in turn return a function
‫that's gonna be sitting here until it's called, all right.
‫And it's best to use this helmet package
‫early in the middleware stack
‫so that these headers are really sure to be set, okay.
‫So don't put it like somewhere at the end
‫put it right in the beginning
‫and actually let's put it really here in the beginning
‫as the first of all middlewares, okay.
‫And we are really growing our middleware stack here
‫let's just give each of them a name.
‫So, security, HTP,
‫headers.
‫That of course, not correct.
‫and too let's actually use a VRP.
‫Set security HTP,
‫limit requests
‫from same API.
‫Now we here we have this one as well.
‫So this is development logging basically.
‫Then this one here is called the body parser.
‫So basically reading
‫data from the body into req.body.
‫Okay.
‫And actually, since we're here,
‫let's implement that thing that I mentioned
‫in the theory lecture
‫where I said that we can limit the amount of data
‫that comes in the body.
‫Remember that?
‫So, here in json, we can actually specify
‫some options and for that as always
‫we pass an object.
‫And so we here can say,
‫limit and let's limit it to 10 kilobyte, okay.
‫And so the package will then understand
‫it will parse this string here
‫into a meaningful data, all right?
‫And so now when we have a body larger than 10 kilobyte
‫it will basically not be accepted, all right?
‫Then finally, this one here
‫is for serving
‫static files, okay.
‫And this is finally just like, some test middleware here.
‫Let's just keep it here because sometimes it's useful.
‫For example, for taking a look at the headers here
‫like we did back then.
‫Okay, so that is helmet.
‫Let's now do a request
‫and then take a look at all the headers
‫that it gives us basically.
‫So let's send it here
‫and then now you see we have 14 headers.
‫So that's a lot more than before
‫and so the new ones are basically this one here,
‫prefetch control off.
‫we have this strict transport security,
‫you have the download options,
‫there's also this one here for XSS protection
‫and so the browser understands these headers
‫and can then act on them basically, all right.
‫Let's quickly actually take a look
‫at the helmet documentation.
‫So of course as always
‫that's on GitHub.
‫And so here you see basically all the middlewares
‫that are included.
‫Because helmet is in fact
‫a collection of multiple middlewares.
‫So that's actually what is says here.
‫So it's a collection of 14 smaller middlewares
‫and some of them are active by default
‫which are these ones here
‫marked like this.
‫And so if you're interested,
‫you can take a look at all of these others
‫and then if you think you need some of them
‫you can of course then turn it on specifically.
‫and it tells you how to do that
‫also up here in the documentation, okay.
‫But I'm fine just with the default options
‫And so...
‫Now, that was actually very simple
‫and so let's now quickly move on to the next video.