Web Development · Advanced level

Advanced level · Module 2: Authentication and Web Security · Lesson 4 of 4

HTTPS, Security Headers and Secrets

Harden deployments with HTTPS, security headers and proper secrets management, and keep dependencies up to date.

In this lesson you will

  • Configure security headers and HTTPS correctly
  • Manage secrets and dependencies safely

Key concepts

HTTPS and HSTSContent-Security-Policysecrets managementdependency updates

The lesson

Serve everything over HTTPS and redirect HTTP to HTTPS. HSTS tells browsers to use HTTPS for your domain in future. Security headers add protection: Content-Security-Policy limits where scripts load from, X-Frame-Options or frame-ancestors prevents clickjacking.

Secrets — database passwords, session keys, API keys — belong in the host's secret settings, never in the repository. If a secret is ever committed, treat it as leaked and replace it.

Most applications are mostly third-party code. Run npm audit, update dependencies regularly and remove packages you no longer use.

Step by step

  1. Add security headers to the Express app.
  2. Check them with the browser's Network tab.
  3. Move all secrets to environment variables and rotate a test secret.
  4. Run npm audit and update vulnerable packages.

Practice activity

Harden the booking platform's configuration and record the before-and-after header check.

Expected result: Security headers are present, no secrets are in the repository and npm audit shows no high-severity issues.

Check your understanding

  1. What does HSTS do?

    Show answer

    Tells browsers to always use HTTPS for the domain.

  2. What should you do if a secret is committed to Git?

    Show answer

    Treat it as leaked: revoke and replace it.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.