Helmet helps you secure your Express apps by setting various HTTP headers. It's not a silver bullet, but it can help!
Looking for a version of Helmet that supports the Koa framework?
First, run npm install helmet --save for your app. Then, in an Express (or Connect) app:
varexpress=require('express')varhelmet=require('helmet')varapp=express()app.use(helmet())// ...It's best to use Helmet early in your middleware stack so that its headers are sure to be set.
You can also use its pieces individually:
app.use(helmet.noCache())app.use(helmet.frameguard())You can disable a middleware that's normally enabled by default. This will disable frameguard but include the other defaults.
app.use(helmet({frameguard: false}))You can also set options for a middleware. Setting options like this will always include the middleware, whether or not it's a default.
app.use(helmet({frameguard: {action: 'deny'}}))If you're using Express 3, make sure these middlewares are listed before app.router.
Helmet is a collection of 12 smaller middleware functions that set HTTP headers. Running app.use(helmet()) will not include all of these middleware functions by default.
| Module | Default? |
|---|---|
| contentSecurityPolicy for setting Content Security Policy | |
| expectCt for handling Certificate Transparency | |
| dnsPrefetchControl controls browser DNS prefetching | ✓ |
| frameguard to prevent clickjacking | ✓ |
| hidePoweredBy to remove the X-Powered-By header | ✓ |
| hpkp for HTTP Public Key Pinning | |
| hsts for HTTP Strict Transport Security | ✓ |
| ieNoOpen sets X-Download-Options for IE8+ | ✓ |
| noCache to disable client-side caching | |
| noSniff to keep clients from sniffing the MIME type | ✓ |
| referrerPolicy to hide the Referer header | |
| xssFilter adds some small XSS protections | ✓ |
You can see more in the documentation.