Front & Fullstack Security

fullstack-security-server.ts

import express from "express";
import fs from "fs";
import helmet from "helmet";
import https from "https";
import path from "path";

const app = express();
// avoid having to manually tweak CSP, HSTS, X-Powered-By, MIME-sniffing, etc.; set the strictest CSP possible
app.use(helmet({ contentSecurityPolicy: { directives: { defaultSrc: "'self'" } } }));
app.use(express.json());

const client = path.resolve(__dirname, "../build");
if (fs.existsSync(client)) app.use(express.static(client));

app.get("/healthz", (_, res) => { res.send({ message: "We're live 🚀" }); });

const httpsOptions = {
  key: fs.readFileSync(path.join(__dirname, "./tls/cert.key")),
  cert: fs.readFileSync(path.join(__dirname, "./tls/cert.pem")),
};

const portHttps = process.env.PORT_HTTPS || 8080;
https.createServer(httpsOptions, app).listen(portHttps, async () => {
  console.log(`HTTPS server listening at ${portHttps}`); // eslint-disable-line no-console
});