Suggestion for Information Security course: update helmet to v5

[harmonify]

When following throughout this course on freeCodeCamp, I noticed that the boilerplate challenges use helmet v3. I suggest to update the curriculum to use helmet v5 as I found out the older version has some security issues.
And one of them is about setting the X-XSS-Protection HTTP header. In helmet v3, using helmet.xssFilter() will set the header to X-XSS-Protection: 1; mode=block. This enables browsers' buggy cross-site scripting filter. Meanwhile in v5, it will set X-XSS-Protection: 0 by default.

Affected page

1. freeCodeCamp's X-XSS-Protection challenge

Expected behavior

1. Using helmet.xssfilter() middleware set the X-XSS-Protection header to 0.

Additional context

1. MDN Documentation on X-XSS-Protection
2. HelmetJS' discussion on X-XSS-Protection
3. Community discussion on X-XSS-Protection

[naomi-lgbt]

We have had a lot of discussion re: whether to continually update the curriculum to keep up with package updates.

The challenges here are:

• The entire block would need to be updated to reflect any breaking changes
• The certification projects would need to be updated to expect + test the latest version.

[moT01]

I don't think it's worth updating this, the project based curriculum will eventually deprecate this. I think our effort is better spent on those.

[naomi-lgbt]

I'm in agreement with Tom here. I'd be in favour of closing this and continuing to focus our efforts on the redesigned curriculum.