# Security Best Practices (Node.js / NestJS) > Helmet, CORS, rate limiting, input sanitization, SQL injection, XSS, CSRF - 25 interview questions - Senior - [Interview Questions: Node.js / NestJS](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions.md) ## 1. What is Helmet in the context of NestJS? **Answer** Helmet is middleware that automatically configures HTTP security headers to protect applications against common vulnerabilities. It enables headers like X-Frame-Options, Content-Security-Policy, X-Content-Type-Options to prevent XSS, clickjacking, and MIME sniffing. Helmet is an essential production best practice to strengthen the security surface. ## 2. What is the main role of CORS in an API? **Answer** CORS (Cross-Origin Resource Sharing) controls which external domains can access API resources. Without CORS configuration, browsers block requests from different domains for security reasons. Properly configuring CORS prevents access errors while maintaining security. Use whitelists of allowed origins rather than allowing all domains with wildcard. ## 3. What is the best approach to protect an API against brute force attacks? **Answer** Rate limiting restricts the number of requests per IP or user over a given period, preventing automated brute force attacks. Packages like throttler-module in NestJS easily configure global or per-endpoint limits. Combine rate limiting with progressive strategies (increasing temporary blocking) and CAPTCHA for sensitive endpoints. Rate limiting also protects against denial of service. ## 22 more questions available - What is an XSS (Cross-Site Scripting) attack? - How to protect a NestJS application against SQL injection? Sign up for free: https://sharpskill.dev/en/login ## Other Node.js / NestJS interview topics - [Node.js Fundamentals](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nodejs-fundamentals.md): 20 questions, Junior - [Node.js Core APIs](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nodejs-core-apis.md): 25 questions, Junior - [Asynchronous Programming](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/asynchronous-programming.md): 25 questions, Junior - [Express.js Basics](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/express-basics.md): 20 questions, Junior - [NestJS Fundamentals](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nestjs-fundamentals.md): 23 questions, Junior - [REST API Design](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/rest-api-design.md): 20 questions, Junior - [Validation & DTO](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/validation-dto.md): 20 questions, Junior - [API Documentation & Contracts](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/api-documentation.md): 20 questions, Junior - [Error Handling](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/error-handling.md): 20 questions, Junior - [Unit Testing](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/testing-unit.md): 20 questions, Junior - [Task Scheduling](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/scheduling-cron.md): 15 questions, Junior - [NestJS Modules & DI](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/nestjs-modules-di.md): 20 questions, Mid-Level - [Configuration & Environment Management](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/configuration-environment.md): 20 questions, Mid-Level - [JWT Authentication](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/authentication-jwt.md): 25 questions, Mid-Level - [Authorization & RBAC](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/authorization-rbac.md): 20 questions, Mid-Level - [Database with TypeORM](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/database-typeorm.md): 30 questions, Mid-Level - [Prisma ORM](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/prisma-orm.md): 25 questions, Mid-Level - [Middleware & Interceptors](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/middleware-interceptors.md): 20 questions, Mid-Level - [File Upload](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/file-upload.md): 15 questions, Mid-Level - [WebSockets](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/websockets.md): 20 questions, Mid-Level - [GraphQL with NestJS](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/graphql-basics.md): 25 questions, Mid-Level - [End-to-End Testing](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/testing-e2e.md): 20 questions, Mid-Level - [Caching with Redis](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/caching-redis.md): 20 questions, Mid-Level - [Queues with Bull](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/queues-bull.md): 20 questions, Mid-Level - [DevOps, Logging & CI/CD](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/logging-monitoring.md): 25 questions, Mid-Level - [Docker & Containerization](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/docker-containerization.md): 25 questions, Mid-Level - [Microservices](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/microservices.md): 30 questions, Senior - [Performance & Cloud Deployment](https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/performance-optimization.md): 30 questions, Senior --- Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack. HTML version of this page: https://sharpskill.dev/en/technologies/node-nestjs/interview-questions/security-best-practices