From f54387e775ed070c11c2d99e6d6cf5fde4425783 Mon Sep 17 00:00:00 2001 From: jikrana Date: Tue, 30 Jun 2026 22:58:44 +0530 Subject: [PATCH] feat: add helmet security headers via separate config module - Fixes #198 --- server/config/helmet.js | 18 ++++++ server/index.js | 5 ++ server/node_modules/.package-lock.json | 14 +++++ server/package-lock.json | 77 +++++--------------------- server/package.json | 1 + 5 files changed, 51 insertions(+), 64 deletions(-) create mode 100644 server/config/helmet.js diff --git a/server/config/helmet.js b/server/config/helmet.js new file mode 100644 index 0000000..a485a2f --- /dev/null +++ b/server/config/helmet.js @@ -0,0 +1,18 @@ +/** + * Helmet Security Headers Configuration + * Provides HTTP security headers to protect against common web vulnerabilities + * @module config/helmet + */ + +import helmet from "helmet"; + +/** + * Configure Helmet middleware with default security headers. + * Keeping it simple to avoid breaking WebSocket (Socket.IO) and CORS. + */ +const helmetMiddleware = helmet({ + // Default Helmet settings are secure and compatible with most APIs. + // No custom overrides needed right now to keep CORS and Socket.IO happy. +}); + +export default helmetMiddleware; \ No newline at end of file diff --git a/server/index.js b/server/index.js index fb20cb6..d5fdaf3 100644 --- a/server/index.js +++ b/server/index.js @@ -29,6 +29,7 @@ import { } from "./middleware/errorHandler.js"; import { apiLimiter } from "./middleware/rateLimiter.js"; +import helmetMiddleware from "./config/helmet.js"; const app = express(); app.use( @@ -42,6 +43,10 @@ app.use( }), ); + +// ==================== SECURITY MIDDLEWARE ==================== +app.use(helmetMiddleware); + // Connect to database connectDB(); // Connect to Redis diff --git a/server/node_modules/.package-lock.json b/server/node_modules/.package-lock.json index c33f806..4de3209 100644 --- a/server/node_modules/.package-lock.json +++ b/server/node_modules/.package-lock.json @@ -1256,6 +1256,8 @@ }, "node_modules/@unrs/resolver-binding-win32-x64-msvc": { "version": "1.12.2", + "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz", + "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==", "cpu": [ "x64" ], @@ -3089,6 +3091,18 @@ "node": ">= 0.4" } }, + "node_modules/helmet": { + "version": "8.2.0", + "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.2.0.tgz", + "integrity": "sha512-DRgTIUgnWcJ62KyarxxziuqYxKGnR6Rgg19BlbucN/dpmJbl1XOit6qvoOX0ZT+HhWe5OUVhU/a1zpGyc1xA0Q==", + "license": "MIT", + "engines": { + "node": ">=18.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/EvanHahn" + } + }, "node_modules/html-escaper": { "version": "2.0.2", "dev": true, diff --git a/server/package-lock.json b/server/package-lock.json index f309119..b4d36d9 100644 --- a/server/package-lock.json +++ b/server/package-lock.json @@ -19,6 +19,7 @@ "express": "^5.1.0", "express-rate-limit": "^8.5.2", "express-validator": "^7.2.1", + "helmet": "^8.2.0", "ioredis": "^5.11.1", "joi": "^18.2.3", "jsonwebtoken": "^9.0.2", @@ -490,40 +491,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@emnapi/core": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz", - "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "@emnapi/wasi-threads": "1.2.1", - "tslib": "^2.4.0" - } - }, - "node_modules/@emnapi/runtime": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz", - "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, - "node_modules/@emnapi/wasi-threads": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz", - "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, "node_modules/@hapi/address": { "version": "5.1.1", "resolved": "https://registry.npmmirror.com/@hapi/address/-/address-5.1.1.tgz", @@ -1219,17 +1186,6 @@ "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==", "license": "MIT" }, - "node_modules/@tybys/wasm-util": { - "version": "0.10.2", - "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz", - "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, "node_modules/@types/babel__core": { "version": "7.20.5", "dev": true, @@ -1343,25 +1299,6 @@ "dev": true, "license": "ISC" }, - "node_modules/@unrs/resolver-binding-win32-x64-msvc": { - "version": "1.12.2", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ] - }, - "node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "license": "MIT", - "engines": { - "node": ">=10.0.0" - } - }, "node_modules/@unrs/resolver-binding-win32-arm64-msvc": { "version": "1.12.2", "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz", @@ -3227,6 +3164,18 @@ "node": ">= 0.4" } }, + "node_modules/helmet": { + "version": "8.2.0", + "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.2.0.tgz", + "integrity": "sha512-DRgTIUgnWcJ62KyarxxziuqYxKGnR6Rgg19BlbucN/dpmJbl1XOit6qvoOX0ZT+HhWe5OUVhU/a1zpGyc1xA0Q==", + "license": "MIT", + "engines": { + "node": ">=18.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/EvanHahn" + } + }, "node_modules/html-escaper": { "version": "2.0.2", "dev": true, diff --git a/server/package.json b/server/package.json index 6d5d956..c41a6c2 100644 --- a/server/package.json +++ b/server/package.json @@ -23,6 +23,7 @@ "express": "^5.1.0", "express-rate-limit": "^8.5.2", "express-validator": "^7.2.1", + "helmet": "^8.2.0", "ioredis": "^5.11.1", "joi": "^18.2.3", "jsonwebtoken": "^9.0.2",