helmet VS Pure

Helmet is an npm package that includes middleware to handle and filter out malicious request headers (exploiting XSS vulnerabilities or clickjacking, for example). You can utilize Helmet's default configuration or customize it based on your needs following the instructions provided here.

helmet

By default, NuxtSecurity will set security response headers to match the values recommended by OWASP and a popular Express.js middleware called helmet.

Utilize security headers and middleware to add another layer of security to your Node.js application. Tools like Helmet.js can help you set secure HTTP headers, while middleware can assist in filtering and sanitizing user inputs.

Documentation Link: helmet

Helmet helps “sanitise” the input, which might not have come from the UI directly. Mongoose is what is known as an Object Document Modelling (ODM), which defines a structure (schema) for the stored data, making it easier to manage in Express. These additions have been omitted from our example stack purely to simplify the tutorial and focus on the fundamental tiers and interfaces.

If you can repro the issue with a minimal tsconfig, with nothing but an import statement then it's probably something the maintainers of helmet would like to see. There's also this (recent) issue I saw looking at their queue -- maybe related? https://github.com/helmetjs/helmet/issues/424 ...

// Security // https://helmetjs.github.io/ app.use(helmet())

You can learn more about each header and how to configure them in the Helmet documentation.

These days I only use middleware if it's global and has no outputs. Helmet comes to mind.

I found Pure.css and it looks nice but maybe there is something better?

Some examples: - https://simplecss.org/ - https://purecss.io/ (I've used this one for over a decade and works great)

You can try https://purecss.io

Now, to test our CSP, we just have to load some external resources. Let's bring on Pure.css and Lodash. Update index.ejs to look like this :

Pure CSS

Personally I don't like either. Bootstrap seems too bloated and cookie-cutter, and Tailwind is inline styles and clutter. Lately I've used Bulma (CSS framework) and Buefy (Bulma + Vue) on a couple of projects. I also like the look of Pure CSS, but I haven't used it.

Pure.

Pure - 22K⭐