Set security headers

Security headers switch on browser protections and remove ambiguous behavior. Choose each one for your application rather than pasting an unexplained block from a blog post.

A useful baseline sets a few headers on every response.

Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

X-Content-Type-Options: nosniff stops the browser from guessing a response’s type, which blocks a text file from being run as script. Referrer-Policy trims what leaks in the Referer header. Permissions-Policy turns off browser features you do not use.

Add HSTS only after HTTPS is fully working, because it forces future requests onto HTTPS and cannot be undone quickly.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Cover every route, not just the home page

Apply headers in middleware so they reach errors and redirects too, then verify the routes people forget.

app.use((req, res, next) => {
  res.set('X-Content-Type-Options', 'nosniff')
  res.set('Referrer-Policy', 'strict-origin-when-cross-origin')
  next()
})

The home page has a strong header set, but framework-generated 404 and 500 responses omit it. An attacker targets the forgotten route where browser protections differ.

Copying every recommended header can break required features or advertise a false policy. Choose values from the application’s real content, framing, and referrer needs.

Capture headers for a normal page, login, redirect, static file, 404, and forced 500. Compare them against the intended baseline and test one blocked framing or MIME-sniffing behavior in a browser.