Intermediate LevelREST APIs & Web Services
What HTTP Security Headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options) protect APIs?
❓ Interview Prompt: Explain HTTP security headers: `Strict-Transport-Security` (HSTS), `Content-Security-Policy` (CSP), `X-Frame-Options`, `X-Content-Type-Options`, and `Helmet` middleware.
Securing HTTP API response headers against common web exploits:
•
'Strict-Transport-Security' (HSTS): Forces browsers to communicate ONLY over encrypted HTTPS ('max-age=31536000; includeSubDomains').
•
'Content-Security-Policy' (CSP): Restricts script, style, and image loading sources, preventing XSS attacks.
•
'X-Frame-Options: DENY': Prevents clickjacking by forbidding embedding the site inside '<iframe>' tags.
•
'X-Content-Type-Options: nosniff': Prevents browser MIME-type sniffing attacks.
Code Implementation Example
typescript
import helmet from 'helmet';
import express from 'express';
const app = express();
// Helmet middleware automatically sets secure HTTP headers!
app.use(helmet());💡Configuring security headers automatically using Helmet middleware in Express.
🎯 Interview Key Takeaway
Use Helmet middleware to apply HSTS, CSP, and X-Content-Type-Options security headers to protect web APIs.
#Security Headers#HSTS#Helmet#Intermediate
Back to all REST APIs & Web Services Questions→