From ca009b904413e379e3b2597ccea51a59d85e0207 Mon Sep 17 00:00:00 2001
From: Benjamin Montgomery <bmontgom@montynet.org>
Date: Fri, 26 Dec 2014 07:50:27 -0500
Subject: [PATCH] move helmet and express.static before sessions for
 performance

---
 config/express.js | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/config/express.js b/config/express.js
index b893259f..872af559 100755
--- a/config/express.js
+++ b/config/express.js
@@ -83,6 +83,16 @@ module.exports = function(db) {
 	app.use(bodyParser.json());
 	app.use(methodOverride());
 
+	// Use helmet to secure Express headers
+	app.use(helmet.xframe());
+	app.use(helmet.xssFilter());
+	app.use(helmet.nosniff());
+	app.use(helmet.ienoopen());
+	app.disable('x-powered-by');
+
+	// Setting the app router and static folder
+	app.use(express.static(path.resolve('./public')));
+
 	// CookieParser should be above session
 	app.use(cookieParser());
 
@@ -106,16 +116,6 @@ module.exports = function(db) {
 	// connect flash for flash messages
 	app.use(flash());
 
-	// Use helmet to secure Express headers
-	app.use(helmet.xframe());
-	app.use(helmet.xssFilter());
-	app.use(helmet.nosniff());
-	app.use(helmet.ienoopen());
-	app.disable('x-powered-by');
-
-	// Setting the app router and static folder
-	app.use(express.static(path.resolve('./public')));
-
 	// Globbing routing files
 	config.getGlobbedFiles('./app/routes/**/*.js').forEach(function(routePath) {
 		require(path.resolve(routePath))(app);
@@ -160,4 +160,4 @@ module.exports = function(db) {
 
 	// Return Express server instance
 	return app;
-};
\ No newline at end of file
+};