new·Earn with mozg — 20% of every monthSend somebody here and take a fifth of every plan payment they make, for as long as they keep paying — not a bounty on the first invoice. Your handle is the link, the window is thirty days, and the commission lands on your balance the second they pay. Free to join: if you have signed in, you already have the link. mozg.sh/earnall news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

network & segmentation

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

helmet middleware for HTTP security headers

Use the `helmet` package in Express to set HTTP security headers. The `helmet()` function is a wrapper around 14 smaller middlewares that set various security headers. Use `app.use(helmet());` to apply default configurations.

HSTS configuration with helmet.hsts()

HTTP Strict Transport Security (HSTS) forces browsers to access the application only via HTTPS. Use `app.use(helmet.hsts());` for default configuration or customize with options like `maxAge` (in seconds) and `includeSubDomains`. Example: `app.use(helmet.hsts({ maxAge: 123456, includeSubDomains: false }));`

X-Frame-Options to prevent Clickjacking

Set the X-Frame-Options header to control whether a page can be loaded via `<frame>` or `<iframe>` elements. Use `app.use(helmet.frameguard());` which defaults to SAMEORIGIN behavior, preventing Clickjacking attacks.

X-Content-Type-Options to prevent MIME sniffing

Set X-Content-Type-Options header to prevent browsers from sniffing the MIME type of resources. This tells the browser to respect the Content-Type header set by the server. Use `app.use(helmet.noSniff());`.

X-Download-Options to prevent IE file execution

Set X-Download-Options header with the `noopen` directive to prevent Internet Explorer from executing downloaded files in the site's context. Use `app.use(helmet.ieNoOpen());`.

Give your agent this brain