{"id":16830,"library":"helmet","title":"Helmet","description":"Helmet is a popular middleware package for Express and Connect applications, designed to enhance web security by automatically setting various HTTP response headers. The current stable version is 8.1.0, compatible with Node.js 18 and later. Helmet typically releases major versions at a moderate pace, incorporating updates to security best practices and deprecating outdated headers. Its key differentiator is its ease of use, providing a sensible default set of 12 security headers out-of-the-box, including `Content-Security-Policy`, `Cross-Origin-Opener-Policy`, and `Strict-Transport-Security`. While providing robust defaults, Helmet is highly configurable, allowing developers to fine-tune individual header directives or disable specific headers entirely to suit their application's needs, making it a go-to solution for foundational web security in Node.js environments.","status":"active","version":"8.1.0","language":"javascript","source_language":"en","source_url":"git://github.com/helmetjs/helmet","tags":["javascript","express","security","headers","backend","content-security-policy","cross-origin-embedder-policy","cross-origin-opener-policy","cross-origin-resource-policy","typescript"],"install":[{"cmd":"npm install helmet","lang":"bash","label":"npm"},{"cmd":"yarn add helmet","lang":"bash","label":"yarn"},{"cmd":"pnpm add helmet","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"Helmet v6+ is primarily designed for ESM. While `require` might work in some CJS contexts, the recommended and type-safe approach for Node.js >=18 is ESM `import`.","wrong":"const helmet = require('helmet');","symbol":"helmet","correct":"import helmet from 'helmet';"},{"note":"Import types for configuration options, especially when using TypeScript, to leverage autocompletion and type checking.","symbol":"HelmetOptions","correct":"import type { HelmetOptions } from 'helmet';"},{"note":"Individual header middlewares can be imported for specific use cases or to override global Helmet settings. Use camelCase for named imports.","wrong":"import { x-content-type-options } from 'helmet';","symbol":"SpecificHeaderMiddleware","correct":"import { xContentTypeOptions } from 'helmet';"}],"quickstart":{"code":"import express from 'express';\nimport helmet from 'helmet';\n\nconst app = express();\nconst PORT = process.env.PORT || 3000;\n\n// Apply Helmet with default security headers\napp.use(helmet());\n\n// Example: Customize Content Security Policy (CSP)\n// This CSP allows scripts only from 'self' (your domain) and 'cdn.example.com'\n// and disallows inline scripts unless explicitly whitelisted with a nonce.\napp.use(\n helmet({\n contentSecurityPolicy: {\n directives: {\n defaultSrc: [\"'self'\"],\n scriptSrc: [\"'self'\", 'cdn.example.com'],\n styleSrc: [\"'self'\", \"'unsafe-inline'\"], // 'unsafe-inline' often needed for CSS frameworks\n imgSrc: [\"'self'\", 'data:'],\n connectSrc: [\"'self'\"],\n fontSrc: [\"'self'\", 'https:', 'data:'],\n objectSrc: [\"'none'\"],\n upgradeInsecureRequests: true,\n },\n },\n }),\n);\n\n// Route to demonstrate the application\napp.get('/', (req, res) => {\n res.send(`\n \n \n \n \n \n Secure App\n \n \n Hello, secure world with Helmet!
\n