Why should you care?

Headers tell browsers to block clickjacking, MIME sniffing, and downgrade attacks.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      connectSrc: ["'self'", process.env.ANGULAR_APP!],
      imgSrc: ["'self'", 'data:', 'https:'],
      frameAncestors: ["'none'"]
    }
  },
  hsts: { maxAge: 31536000, includeSubDomains: true }
}));

What happened?

• CSP limits script and connect sources.
• frameAncestors none prevents iframe embed clickjacking.
• HSTS forces HTTPS for one year.

Practice next

1. app.use(helmet()) with defaults first.
2. Tune CSP for Angular inline needs minimally.
3. Test app in browser console for CSP violations.
4. Add report-uri for CSP violation reports.
5. Use helmet.crossOriginResourcePolicy for API-only server.

Remember

Helmet = one middleware, many headers. CSP reduces XSS blast radius. Configure per MeanVerse deployment URLs.

Security scanner pass

Qualys flags missing X-Content-Type-Options.

Outcome: helmet() adds nosniff; scan grade improves.