Build HTTP APIs with routing, middleware, validation, controllers, and error handling.
Lessons
Apply HTTPS, secure cookies, and safe defaults in production.
Securing API Responses is easiest to learn by reading the example, changing it, and observing the result.
import express from 'express';
import helmet from 'helmet';
const app = express();
app.use(helmet()); // sensible security headers by default
app.disable('x-powered-by'); // hide framework fingerprint
app.get('/health', (req, res) => res.json({ status: 'ok' }));
app.listen(3000);Practice the Securing API Responses example in a small scratch file, then explain what changed and why.
In accordance with Section 6 & Section 7 of the DPDP Act 2023, third-party analytics and marketing trackers are strictly gated behind your affirmative consent. You may withdraw consent at any time under Section 6(4).
Essential for session authentication (ci_session), Cross-Site Request Forgery security (csrf_cookie_name), and Cloudflare DDoS/bot prevention. Cannot be disabled.
Gated under DPDP Section 7. Allows Google Analytics 4 (Google Consent Mode v2) to measure aggregate, anonymized tool usage.
Enables browser local storage to preserve your theme selection (dark/light mode) and code editor layout between visits.
Used to display developer sponsorships and native tool partner notices.