Build HTTP APIs with routing, middleware, validation, controllers, and error handling.
Lessons
Harden responses with sensible default security headers.
Security Headers with Helmet is easiest to learn by reading the example, changing it, and observing the result.
import express from 'express';
import helmet from 'helmet';
const app = express();
app.use(helmet()); // sensible security headers by default
app.disable('x-powered-by'); // hide framework fingerprint
app.get('/health', (req, res) => res.json({ status: 'ok' }));
app.listen(3000);Practice the Security Headers with Helmet example in a small scratch file, then explain what changed and why.