Secure headers with Express

middleware.js

const setSecureHeaders = (req, res, next) => {
  res.setHeader("X-Powered-By", "a_whole_lotta_coffee");
  res.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';");
  res.setHeader("Referrer-Policy", "no-referrer");
  res.setHeader("X-XSS-Protection", "1; mode=block")
  res.setHeader("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate")
  res.setHeader("Expires", "-1")
  res.setHeader("Pragma", "no-cache")
  res.setHeader("Feature-Policy", "microphone 'none'; camera 'none'; fullscreen 'none'; payment 'none';")
  next();
}

module.exports = { setSecureHeaders }

server.js

const express = require("express");
const { setSecureHeaders } = require('./controllers/middleware')

const app = express();

const PORT = 9000;

app.use(setSecureHeaders);
app.use(express.static("./public"));

require("./controllers/routes.js")(app);

app.listen(PORT, function() {
	console.log("App serving on: " + PORT);
});