feat: add helmet security headers via separate config module - Fixes …

server/config/helmet.js

@@ -0,0 +1,18 @@
+/**
+ * Helmet Security Headers Configuration
+ * Provides HTTP security headers to protect against common web vulnerabilities
+ * @module config/helmet
+ */
+
+import helmet from "helmet";
+
+/**
+ * Configure Helmet middleware with default security headers.
+ * Keeping it simple to avoid breaking WebSocket (Socket.IO) and CORS.
+ */
+const helmetMiddleware = helmet({
+  // Default Helmet settings are secure and compatible with most APIs.
+  // No custom overrides needed right now to keep CORS and Socket.IO happy.
+});
+
+export default helmetMiddleware;

server/index.js

@@ -29,6 +29,7 @@ import {
 } from "./middleware/errorHandler.js";
 import { apiLimiter } from "./middleware/rateLimiter.js";
 
+import helmetMiddleware from "./config/helmet.js";
 const app = express();
 
 app.use(
@@ -42,6 +43,10 @@ app.use(
   }),
 );
 
+
+// ==================== SECURITY MIDDLEWARE ====================
+app.use(helmetMiddleware);
+
 // Connect to database
 connectDB();
 // Connect to Redis

server/package.json

@@ -23,6 +23,7 @@
     "express": "^5.1.0",
     "express-rate-limit": "^8.5.2",
     "express-validator": "^7.2.1",
+    "helmet": "^8.2.0",
     "ioredis": "^5.11.1",
     "joi": "^18.2.3",
     "jsonwebtoken": "^9.0.2",