Fix Security Misconfiguration in Express

const express = require('express');
const app = express();
// Problem: Default headers leak ‘X-Powered-By: Express’
// Problem: No CSP, HSTS, or No-Sniff headers
app.get(’/’, (req, res) => {
res.send(‘Vulnerable Server’);
});
app.listen(3000);

const express = require('express');
const helmet = require('helmet');
const app = express();
// 1. Disable fingerprinting to hide the tech stack
app.disable(‘x-powered-by’);
// 2. Use Helmet to set 15+ security headers (CSP, HSTS, etc.)
app.use(helmet());
// 3. Explicitly configure secure session cookies
const session = require(‘express-session’);
app.use(session({
secret: ‘hardened_secret_key’,
cookie: {
httpOnly: true,
secure: true,
sameSite: ‘strict’
},
resave: false,
saveUninitialized: true
}));
app.get(’/’, (req, res) => {
res.send(‘Hardened Server’);
});
app.listen(3000);