What is Helmet in Express?

Helmet is a collection of 15 smaller middleware functions that set various HTTP headers to help secure your Express.js applications. It's designed to protect Node.js applications from well-known web vulnerabilities by configuring appropriate HTTP headers.

What is Helmet?

Helmet is a middleware package for Express.js (and other Connect-based frameworks) that enhances the security of web applications by setting various HTTP response headers. By default, it includes several middleware functions that automatically apply common security practices, protecting against many common attacks like cross-site scripting (XSS), clickjacking, and others.

Why Use Helmet?

Using Helmet helps developers easily implement security best practices without having to manually configure each HTTP header. It significantly reduces the attack surface of an application by providing sensible defaults for security-related headers. This makes your application more robust against common exploits and helps in achieving compliance with security standards.

Key Helmet Middleware Functions (Examples)

Helmet combines several independent middleware functions. Some of the most commonly used ones include:

• contentSecurityPolicy: Sets the Content-Security-Policy header to prevent cross-site scripting attacks and other content injection attacks.
• dnsPrefetchControl: Controls browser DNS prefetching by setting the X-DNS-Prefetch-Control header.
• expectCt: Forces HTTPS for clients that support Certificate Transparency.
• frameguard: Prevents clickjacking by setting the X-Frame-Options header.
• hidePoweredBy: Removes the X-Powered-By header, which can reveal the technology stack.
• hsts: Adds the Strict-Transport-Security header to enforce secure (HTTP over SSL/TLS) connections to the server.
• ieNoOpen: Sets X-Download-Options for IE8+, preventing downloads from automatically executing.
• noSniff: Prevents browsers from MIME-sniffing a response away from the declared content-type.
• permittedCrossDomainPolicies: Sets the X-Permitted-Cross-Domain-Policies header to prevent unwanted cross-domain requests.
• referrerPolicy: Sets the Referrer-Policy header to control how much referrer information is sent with requests.
• xssFilter: Sets the X-XSS-Protection header to enable the browser's built-in XSS filter.

How to Use Helmet

Using Helmet in an Express application is straightforward. First, install it via npm, then require it in your application, and finally, use it as a middleware.

npm install helmet

const express = require('express');
const helmet = require('helmet');
const app = express();

// Use Helmet to apply all default security headers
app.use(helmet());

// Your routes and other middleware
app.get('/', (req, res) => {
  res.send('Hello Secure World!');
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

Helmet can also be configured to enable or disable specific middleware functions, or to customize their settings. For instance, to disable hidePoweredBy:

app.use(helmet({
  hidePoweredBy: false
}));

Or to configure contentSecurityPolicy:

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'", "trusted-cdn.com"]
    }
  }
}));