06 - Prevent IE from Opening Untrusted HTML with helmet.ieNoOpen() - freeCodeCamp
IMPORTANT: Use Helmet version 2.3.0 to pass this test!
It's still important to ensure we are patched against vulnerabilities that only affect older browsers like Internet Explorer. Here, we set a Header to prevent IE from dangerously executing downloaded scripts inside our website.
Link to Challenge : https://www.freecodecamp.org/learn/in...
Written Guide: https://www.notion.so/ganeshh123/Prev...
Full Playlist for this course : • Information Security with HelmetJS - ...
All Writen Guides for this course : https://www.notion.so/ganeshh123/8ba8...
All My Tutorials can be found at : https://www.notion.so/Tutorials-Ganes...
00:00 - Introduction
00:03 - Why we should still support Internet Explorer
00:20 - Vulnerability of Internet Explorer
01:28 - X-Download-Options Header
This disables the option to open a file directly on download.
http://www.fizerkhan.com/blog/posts/S...
02:20 - Use Helmet version 2.3.0
02:48 - Setting the Header - helmet.ieNoOpen()
helmet.ieNoOpen sets the X-Download-Options header, which is specific to Internet Explorer 8. It forces potentially-unsafe downloads to be saved, mitigating execution of HTML in your site's context.
https://github.com/helmetjs/helmet/tr...
03:37 - Explanation of Solution
————————————————————————————————————
HelmetJS is a type of middleware for Express-based applications that automatically sets HTTP headers to prevent sensitive information from unintentionally being passed between the server and client. While HelmetJS does not account for all situations, it does include support for common ones like Content Security Policy, XSS Filtering, and HTTP Strict Transport Security, among others. HelmetJS can be installed on an Express project from npm, after which each layer of protection can be configured to best fit the project.
freeCodeCamp (also referred to as “Free Code Camp”) is a non-profit organization that consists of an interactive learning web platform, an online community forum, chat rooms, online publications and local organizations that intend to make learning web development accessible to anyone. Beginning with tutorials that introduce students to HTML, CSS and JavaScript, students progress to project assignments that they complete either alone or in pairs. Upon completion of all project tasks, students are partnered with other nonprofits to build web applications, giving the students practical development experience.
freeCodeCamp (also referred to as “Free Code Camp”) is a non-profit organization that consists of an interactive learning web platform, an online community forum, chat rooms, online publications and local organizations that intend to make learning web development accessible to anyone. Beginning with tutorials that introduce students to HTML, CSS and JavaScript, students progress to project assignments that they complete either alone or in pairs. Upon completion of all project tasks, students are partnered with other nonprofits to build web applications, giving the students practical development experience.
Thanks for Watching!