Baseline security headers
Reducing exposure to common browser and web attacks in an Express application.
Express.js · Module
helmet
Helmet is Express middleware that sets security-related HTTP response headers. Install it separately and register helmet() with app.use().
How it works
Helmet is an additional middleware module for Express that improves application security by adding security-related HTTP response headers. Register it with app.use so those headers are applied to responses handled by the application.
Syntax
app.use(helmet());Returns
Middleware function
Key points
- Helmet improves an Express application's security posture by adding a collection of HTTP response headers.
- Its API shape is middleware: call helmet() and mount the returned function in the Express middleware chain.
- The module supplies a default header set rather than requiring every security header to be configured manually.
- Content-Security-Policy restricts permitted page behavior through an allow-list, helping mitigate several attack classes.
- Strict-Transport-Security instructs browsers to favor HTTPS connections.
- X-Content-Type-Options helps prevent browsers from interpreting content using an inferred MIME type.
Common mistakes
- Helmet's headers are not immutable; configure or disable individual headers when the application's requirements differ from the defaults.
- Do not expect Helmet to enable X-XSS-Protection: the documentation identifies it as harmful and says Helmet disables it.
Example: Register Helmet middleware
const express = require('express');
const helmet = require('helmet');
const app = express();
app.use(helmet());
app.get('/', (_req, res) => res.send('ok'));
app.listen(3000);Install Helmet separately, then register its middleware on the Express application.
When to use it
HTTPS preference
Enforcing HTTPS preference for browsers through the Strict-Transport-Security response header.
Content policy
Controlling which page behaviors are allowed with Content-Security-Policy.
Interview questions
QWhat is Helmet, and how is it added to an Express app?
Helmet is middleware that sets security-related HTTP response headers. It is installed as a separate module and registered with app.use(helmet()).
Follow-up: Which Express setting complements Helmet by removing the framework-identifying header? Use app.disable('x-powered-by').
QWhat does Helmet configure by default?
Helmet sets several headers by default, including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and X-Frame-Options. These headers help control browser behavior and reduce exposure to common web attacks.
Follow-up: Can the defaults be changed? Yes; each header can be configured or disabled.
QHow do you install and load Helmet?
Helmet is not part of Express's built-in middleware list; it is an additional middleware module. The documented installation command is npm install helmet, after which the module is imported or required.
Follow-up: How would you use it with CommonJS? Require it with const helmet = require('helmet') and pass helmet() to app.use.
Related
app.use()app.disable()express()X-Powered-By