Security Headers in Node.js
From the Express.js cheat sheet · CORS & Security · verified Jul 2026
Security Headers
Add security headers to protect against common vulnerabilities
javascript
const helmet = require('helmet');
// Use helmet for security headers
app.use(helmet());
// Rate limiting
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 requests
message: 'Too many requests'
});
app.use('/api/', limiter);
// Prevent NoSQL injection (Express 5: req.query is read-only, so
// express-mongo-sanitize throws - sanitize at the data layer instead,
// e.g. parameterized queries + a maintained sanitizer that skips req.query)🔒 Helmet adds various security headers
⚡ Rate limiting prevents abuse
💡 Sanitize inputs to prevent injection
✅ Use HTTPS in production always