{"repo":"helmetjs/helmet","free":true,"listed":false,"github":"https://github.com/helmetjs/helmet","clone":"git clone https://github.com/helmetjs/helmet.git","description":"Help secure Express apps with various HTTP headers","language":"TypeScript","stars":10718,"topics":["javascript","middleware","security","helmet","http-headers"],"license":"MIT","category":"security-tools","readme_excerpt":"Helmet Helmet helps secure Node/Express apps. It sets HTTP response headers such as Content-Security-Policy and Strict-Transport-Security . It aims to be quick to integrate and be low maintenance afterward. Quick start This will set 13 HTTP response headers in your app. See the docs for more info, including the FAQ. Configuration Each header can be disabled. To disable a header: To configure a header, pass header-specific options: HTTP header reference Content-Security-Policy Default (formatted for readability): The Content-Security-Policy header mitigates a large number of attacks, such as [cross-site scripting][XSS]. See MDN's introductory article on Content Security Policy. This header is powerful but likely requires some configuration for your specific app. To configure this header, pass an object with a nested directives object. Each key is a directive name in camel case (such as defaultSrc ) or kebab case (such as default-src ). Each value is an array (or other iterable) of strings or functions for that directive. If a function appears in the array, it will be called with the request and response objects. These directives are merged into a default policy, which you can disable by setting useDefaults to false . You can get the default directives object with helmet.contentSecurityPolicy.getDefaultDirectives() . Here is the default policy (formatted for readability): The default-src directive can be explicitly disabled by setting its value to helmet.contentSecurityPolicy.d","default_branch":null,"files":null,"tree":[],"storefront":"/r/helmetjs","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/helmetjs/helmet/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}