helmet
    Overview
    Playground
    Code
    Issues
    Career Opportunities
    Alternatives
    Dependencies
    Documentation
    Find an Expert
    Versions
    Insights & Analysis

helmet

help secure Express/Connect apps with various HTTP headers

3.20.0  •  Published 1 month ago  •  by Adam Baldwin  •  MIT License

Helmet

npm version npm dependency status Build Status FOSSA Status

Helmet helps you secure your Express apps by setting various HTTP headers. It’s not a silver bullet, but it can help!

Looking for a version of Helmet that supports the Koa framework?

Quick start

First, run npm install helmet --save for your app. Then, in an Express (or Connect) app:

const express = require('express')
const helmet = require('helmet')

const app = express()

app.use(helmet())

// ...

It’s best to use Helmet early in your middleware stack so that its headers are sure to be set.

You can also use its pieces individually:

app.use(helmet.xssFilter())
app.use(helmet.frameguard())

You can disable a middleware that’s normally enabled by default. This will disable frameguard but include the other defaults.

app.use(helmet({
  frameguard: false
}))

You can also set options for a middleware. Setting options like this will always include the middleware, whether or not it’s a default.

app.use(helmet({
  frameguard: {
    action: 'deny'
  }
}))

If you’re using Express 3, make sure these middlewares are listed before app.router.

How it works

Helmet is a collection of 14 smaller middleware functions that set HTTP response headers. Running app.use(helmet()) will not include all of these middleware functions by default.

Module Default?
contentSecurityPolicy for setting Content Security Policy
crossdomain for handling Adobe products’ crossdomain requests
dnsPrefetchControl controls browser DNS prefetching
expectCt for handling Certificate Transparency
featurePolicy to limit your site’s features
frameguard to prevent clickjacking
hidePoweredBy to remove the X-Powered-By header
hpkp for HTTP Public Key Pinning
hsts for HTTP Strict Transport Security
ieNoOpen sets X-Download-Options for IE8+
noCache to disable client-side caching
noSniff to keep clients from sniffing the MIME type
referrerPolicy to hide the Referer header
xssFilter adds some small XSS protections

You can see more in the documentation.

Dependencies

depd  ·  dns-prefetch-control  ·  dont-sniff-mimetype  ·  expect-ct  ·  feature-policy  ·  frameguard  ·  helmet-crossdomain  ·  helmet-csp  ·  hide-powered-by  ·  hpkp  ·  hsts  ·  ienoopen  ·  nocache  ·  referrer-policy  ·  x-xss-protection  ·  connect  ·  mocha  ·  sinon  ·  standard  ·  supertest

Tags

security
headers
express
connect
x-frame-options
x-powered-by
csp
hsts
clickjack
Get an open source license report with a click
Whether it's for legal, customers or investors, upload your package.json files, and get a comprehensive license report page and spreadsheet. No hassle, it just works!
$49 one time fee, money back guarantee

Popularity

Weekly Downloads
586.9K
Stars
6.2K

Issues and PRs

Activity

Last ver 1 month ago
Created 8 years ago
Last commit 1 month ago
5 days between commits

Sustainability

28 contributors

Technology

Node version: 12.6.0
24.1K unpacked

Legal and Compliance

MIT License
OSI Approved
0 vulnerabilities

Top Experts

Evan Hahn
Maintainer, 466 commits, 22 merges, 9 PRs
Works at Airtable
Adam Baldwin
66 commits
Adam Baldwin
Maintainer, 11 merges
Works at npm
Matt Johansen
7 commits, 2 PRs
Works at Honest Dollar
thefourtheye
4 commits, 3 PRs
Michael Garvin
3 commits, 1 PRs