Learn about the Helmet library of Node.js for HTTP headers and test the security.

Web App Security

This module teaches us hands-on practical use of HTTP security headers as browser security controls to help secure web applications. 
For each HTTP security header that can enhance our web application security, we'll look at the potential risk of not implementing it as well as the benefits of employing a solution that we propose. Finally, we'll learn how to implement and configure the security header with Helmet, a popular and well-maintained Node.js package on npm.

Web Application Security: Understanding HTTP Security Headers

The HTTP header **X-XSS-Protection** is used by IE8 and IE9 and allows the Cross-Site-Scripting (XSS) filter capability that is built into the browser to be toggled on or off.

Turning XSS filtering on for any IE8 and IE9 browsers rendering your web application requires the following HTTP header to be sent:

```
X-XSS-Protection: 1; mode=block
```

With Helmet, this protection can be turned on using the following snippet:

```js
const helmet = require("helmet");

app.use(helmet.xssFilter());
```

The following is a quick lesson to recap browser-specific Cross-site Scripting protection. While not in active use anymore, this security header is simply a server response and it is still effective to employ.

Introduction

HTTP Security Headers

Testing for Security Headers

What's Next

Conclusion

X XSS Protection