Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Which Helmet header specifically prevents your login page from being embedded in a hidden iframe on an attacker's site (clickjacking)?
💻 Code Challenge | +75 XP
Configure Helmet on an Express app with a custom Content-Security-Policy that allows scripts from "self" and a trusted CDN, while keeping all other Helmet defaults active.
A payment page embedding a third-party widget is being blocked by a global strict CSP. Reorder the steps to fix it without weakening security everywhere else.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Assuming helmet() alone makes an application secure
// Helmet helps, but does not replace:
// - Input validation
// - Parameterized queries
// - Proper authentication/authorizationThe Solution //
Helmet sets defensive HTTP headers, which is one layer among many — it does nothing to prevent SQL injection, broken authentication, or insecure direct object references. Treat it as one item on a security checklist, not a complete solution.
The Error //
Setting an overly permissive CSP like script-src *, defeating its purpose
// Wrong: defeats the purpose of CSP entirely
scriptSrc: ["*"]
// Correct: explicit allowlist
scriptSrc: ["'self'", "trusted-cdn.com"]The Solution //
A wildcard script-src allows scripts from any origin, which provides essentially no XSS protection — the whole point of CSP is restricting sources to a known-safe allowlist. List each specific trusted origin explicitly instead.