Node services that expose public APIs should apply security headers to their responses. While some generic headers may be applied by the API gateway, API endpoints may want to provide headers tuned specifically to their response.

Sharing code for emitting security headers could be achieved by creating an npm module for this purpose. This npm module should then be referenced from the service template / scaffolding.

Beyond sharing code, services also need to share knowledge about the deployment environment, in the form of configuration. This includes knowledge e.g. about trusted sources for media files or JavaScript code. This could perhaps be done using Helm charts, k8s config maps, or etcd.