helmet

# Helmet

Helmet helps secure Node/Express apps. It sets HTTP response headers such as `Content-Security-Policy` and `Strict-Transport-Security`. It aims to be quick to integrate and be low maintenance afterward.

## Quick start

```javascript
import helmet from "helmet";

const app = express();

app.use(helmet());
```

This will set 13 HTTP response headers in your app.

See [the docs](https://helmet.js.org/) for more info, including [the FAQ](https://helmet.js.org/faq/).

## Configuration

Each header can be disabled. To disable a header:

```js
// Disable the Content-Security-Policy and X-Download-Options headers
app.use(
  helmet({
    contentSecurityPolicy: false,
    xDownloadOptions: false,
  }),
);
```

To configure a header, pass header-specific options:

```js
// Configure the Content-Security-Policy header.
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "script-src": ["'self'", "example.com"],
      },
    },
  }),
);
```

## HTTP header reference

<details id="content-security-policy">
<summary><code>Content-Security-Policy</code></summary>

Default (formatted for readability):

```
Content-Security-Policy:
  default-src 'self'
  base-uri 'self'
  font-src 'self' https: data:
  form-action 'self'
  frame-ancestors 'self'
  img-src 'self' data:
  object-src 'none'
  script-src 'self'
  script-src-attr 'none'
  style-src 'self' https: 'unsafe-inline'
  upgrade-insecure-requests
```

The `Content-Security-Policy` header mitigates a large number of attacks, such as [cross-site scripting][XSS]. See [MDN's introductory article on Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP).

This header is powerful but likely requires some configuration for your specific app.

To configure this header, pass an object with a nested `directives` object. Each key is a directive name in camel case (such as `defaultSrc`) or kebab case (such as `default-src`). Each value is an array (or other iterable) of strings or functions for that directive. If a function appears in the array, it will be called with the request and response objects.

```javascript
// Sets all of the defaults, but overrides `script-src`
// and disables the default `style-src`.
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "script-src": ["'self'", "example.com"],
        "style-src": null,
      },
    },
  }),
);
```

```js
// Sets the `script-src` directive to
// "'self' 'nonce-e33cc...'"
// (or similar)
app.use((req, res, next) => {
  res.locals.cspNonce = crypto.randomBytes(32).toString("hex");
  next();
});
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
      },
    },
  }),
);
```

These directives are merged into a default policy, which you can disable by setting `useDefaults` to `false`.

```javascript
// Sets "Content-Security-Policy: default-src 'self';
// script-src 'self' example.com;obje