Helmet in NestJS, as an exercise

What you'll learn

Explain what security response headers do: instructions to the browser, enforced by the browser, that cost the server nothing
Register helmet as the first global middleware so every response, including errors and 404s, carries its headers
Read the headers helmet sets by default and name the ones that matter for a JSON API
Adjust one content security policy directive without losing the others, and turn a header off when it must be

Press Run tests to start the app. Its log appears here.

The body is the usual JSON; the headers are helmet's, including the content security policy with the shelter's image sources merged into the defaults
Middleware runs before routing, so a response Nest generates for a route that does not exist carries the same headers
The rest of the API is unchanged; every response carries the headers
Guarded as in lesson 1
A 401 the guard produced, with the headers too
Staff add a cat
Public
Even a 204 with no body carries the headers

run the tests first