helmetjs / helmet

Help secure Express apps with various HTTP headers

Helmet

Help secure Express apps by setting HTTP response headers.

import helmet from "helmet";

const app = express();

app.use(helmet());

Helmet sets the following headers by default:

• Content-Security-Policy: A powerful allow-list of what can happen on your page which mitigates many attacks
• Cross-Origin-Opener-Policy: Helps process-isolate your page
• Cross-Origin-Resource-Policy: Blocks others from loading your resources cross-origin
• Origin-Agent-Cluster: Changes process isolation to be origin-based
• Referrer-Policy: Controls the Referer header
• Strict-Transport-Security: Tells browsers to prefer HTTPS
• X-Content-Type-Options: Avoids MIME sniffing
• X-DNS-Prefetch-Control: Controls DNS prefetching
• X-Download-Options: Forces downloads to be saved (Internet Explorer only)
• X-Frame-Options: Legacy header that mitigates clickjacking attacks
• X-Permitted-Cross-Domain-Policies: Controls cross-domain behavior for Adobe products, like Acrobat
• X-Powered-By: Info about the web server. Removed because it could be used in simple attacks
• X-XSS-Protection: Legacy header that tries to mitigate XSS attacks, but makes things worse, so Helmet disables it

Each header can be configured. For example, here's how you configure the Content-Security-Policy header:

// Configure the Content-Security-Policy header.
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "script-src": ["'self'", "example.com"],
      },
    },
  }),
);

Headers can also be disabled. For example, here's how you disable the Content-Security-Policy and X-Download-Options headers:

// Disable the Content-Security-Policy and X-Download-Options headers
app.use(
  helmet({
    contentSecurityPolicy: false,
    xDownloadOptions: false,
  }),
);

Reference

Content-Security-Policy

Default:

Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests

The Content-Security-Policy header mitigates a large number of attacks, such as cross-site scripting. See MDN's introductory article on Content Security Policy.

This header is powerful but likely requires some configuration for your specific app.

To configure this header, pass an object with a nested directives object. Each key is a directive name in camel case (such as defaultSrc) or kebab case (such as default-src). Each value is an array (or other iterable) of strings or functions for that directive. If a function appears in the array, it will be called with the request and response objects.

// Sets all of the defaults, but overrides `script-src`
// and disables the default `style-src`.
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "script-src": ["'self'", "example.com"],
        "style-src": null,
      },
    },
  }),
);

// Sets the `script-src` directive to
// "'self' 'nonce-e33cc...'"
// (or similar)
app.use((req, res, next) => {
  res.locals.cspNonce = crypto.randomBytes(32).toString("hex");
  next();
});
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
      },
    },
  }),
);

These directives are merged into a default policy, which you can disable by setting useDefaults to false.

// Sets "Content-Security-Policy: default-src 'self';
// script-src 'self' example.com;object-src 'none';
// upgrade-insecure-requests"
app.use(
  helmet({
    contentSecurityPolicy: {
      useDefaults: false,
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "example.com"],
        objectSrc: ["'none'"],
        upgradeInsecureRequests: [],
      },
    },
  }),
);

You can get the default directives object with helmet.contentSecurityPolicy.getDefaultDirectives(). Here is the default policy (formatted for readability):

default-src 'self';
base-uri 'self';
font-src 'self' https: data:;
form-action 'self';
frame-ancestors 'self';
img-src 'self' data:;
object-src 'none';
script-src 'self';
script-src-attr 'none';
style-src 'self' https: 'unsafe-inline';
upgrade-insecure-requests

The default-src directive can be explicitly disabled by setting its value to helmet.contentSecurityPolicy.dangerouslyDisableDefaultSrc, but this is not recommended.

You can set the Content-Security-Policy-Report-Only instead:

// Sets the Content-Security-Policy-Report-Only header
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        /* ... */
      },
      reportOnly: true,
    },
  }),
);

Helmet performs very little validation on your CSP. You should rely on CSP checkers like CSP Evaluator instead.

To disable the Content-Security-Policy header:

app.use(
  helmet({
    contentSecurityPolicy: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.contentSecurityPolicy()).

Cross-Origin-Embedder-Policy

This header is not set by default.

The Cross-Origin-Embedder-Policy header helps control what resources can be loaded cross-origin. See MDN's article on this header for more.

// Helmet does not set Cross-Origin-Embedder-Policy
// by default.
app.use(helmet());

// Sets "Cross-Origin-Embedder-Policy: require-corp"
app.use(helmet({ crossOriginEmbedderPolicy: true }));

// Sets "Cross-Origin-Embedder-Policy: credentialless"
app.use(helmet({ crossOriginEmbedderPolicy: { policy: "credentialless" } }));

You can use this as standalone middleware with app.use(helmet.crossOriginEmbedderPolicy()).

Cross-Origin-Opener-Policy

Default:

Cross-Origin-Opener-Policy: same-origin

The Cross-Origin-Opener-Policy header helps process-isolate your page. For more, see MDN's article on this header.

// Sets "Cross-Origin-Opener-Policy: same-origin"
app.use(helmet());

// Sets "Cross-Origin-Opener-Policy: same-origin-allow-popups"
app.use(
  helmet({
    crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
  }),
);

To disable the Cross-Origin-Opener-Policy header:

app.use(
  helmet({
    crossOriginOpenerPolicy: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.crossOriginOpenerPolicy()).

Cross-Origin-Resource-Policy

Default:

Cross-Origin-Resource-Policy: same-origin

The Cross-Origin-Resource-Policy header blocks others from loading your resources cross-origin in some cases. For more, see "Consider deploying Cross-Origin Resource Policy and MDN's article on this header.

// Sets "Cross-Origin-Resource-Policy: same-origin"
app.use(helmet());

// Sets "Cross-Origin-Resource-Policy: same-site"
app.use(helmet({ crossOriginResourcePolicy: { policy: "same-site" } }));

To disable the Cross-Origin-Resource-Policy header:

app.use(
  helmet({
    crossOriginResourcePolicy: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.crossOriginResourcePolicy()).

Origin-Agent-Cluster

Default:

Origin-Agent-Cluster: ?1

The Origin-Agent-Cluster header provides a mechanism to allow web applications to isolate their origins from other processes. Read more about it in the spec.

This header takes no options and is set by default.

// Sets "Origin-Agent-Cluster: ?1"
app.use(helmet());

To disable the Origin-Agent-Cluster header:

app.use(
  helmet({
    originAgentCluster: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.originAgentCluster()).

Referrer-Policy

Default:

Referrer-Policy: no-referrer

The Referrer-Policy header which controls what information is set in the Referer request header. See "Referer header: privacy and security concerns" and the header's documentation on MDN for more.

// Sets "Referrer-Policy: no-referrer"
app.use(helmet());

policy is a string or array of strings representing the policy. If passed as an array, it will be joined with commas, which is useful when setting a fallback policy. It defaults to no-referrer.

// Sets "Referrer-Policy: no-referrer"
app.use(
  helmet({
    referrerPolicy: {
      policy: "no-referrer",
    },
  }),
);

// Sets "Referrer-Policy: origin,unsafe-url"
app.use(
  helmet({
    referrerPolicy: {
      policy: ["origin", "unsafe-url"],
    },
  }),
);

To disable the Referrer-Policy header:

app.use(
  helmet({
    referrerPolicy: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.referrerPolicy()).

Strict-Transport-Security

Default:

Strict-Transport-Security: max-age=15552000; includeSubDomains

The Strict-Transport-Security header tells browsers to prefer HTTPS instead of insecure HTTP. See the documentation on MDN for more.

// Sets "Strict-Transport-Security: max-age=15552000; includeSubDomains"
app.use(helmet());

maxAge is the number of seconds browsers should remember to prefer HTTPS. If passed a non-integer, the value is rounded down. It defaults to 15552000, which is 180 days.

includeSubDomains is a boolean which dictates whether to include the includeSubDomains directive, which makes this policy extend to subdomains. It defaults to true.

preload is a boolean. If true, it adds the preload directive, expressing intent to add your HSTS policy to browsers. See the "Preloading Strict Transport Security" section on MDN for more. It defaults to false.

// Sets "Strict-Transport-Security: max-age=123456; includeSubDomains"
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 123456,
    },
  }),
);

// Sets "Strict-Transport-Security: max-age=123456"
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 123456,
      includeSubDomains: false,
    },
  }),
);

// Sets "Strict-Transport-Security: max-age=123456; includeSubDomains; preload"
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 63072000,
      preload: true,
    },
  }),
);

To disable the Strict-Transport-Security header:

app.use(
  helmet({
    strictTransportSecurity: false,
  }),
);

You may wish to disable this header for local development, as it can make your browser force redirects from http://localhost to https://localhost, which may not be desirable if you develop multiple apps using localhost. See this issue for more discussion.

You can use this as standalone middleware with app.use(helmet.strictTransportSecurity()).

X-Content-Type-Options

Default:

X-Content-Type-Options: nosniff

The X-Content-Type-Options mitigates MIME type sniffing which can cause security issues. See documentation for this header on MDN for more.

This header takes no options and is set by default.

// Sets "X-Content-Type-Options: nosniff"
app.use(helmet());

To disable the X-Content-Type-Options header:

app.use(
  helmet({
    xContentTypeOptions: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xContentTypeOptions()).

X-DNS-Prefetch-Control

Default:

X-DNS-Prefetch-Control: off

The X-DNS-Prefetch-Control header helps control DNS prefetching, which can improve user privacy at the expense of performance. See documentation on MDN for more.

// Sets "X-DNS-Prefetch-Control: off"
app.use(helmet());

allow is a boolean dictating whether to enable DNS prefetching. It defaults to false.

Examples:

// Sets "X-DNS-Prefetch-Control: off"
app.use(
  helmet({
    xDnsPrefetchControl: { allow: false },
  }),
);

// Sets "X-DNS-Prefetch-Control: on"
app.use(
  helmet({
    xDnsPrefetchControl: { allow: true },
  }),
);

To disable the X-DNS-Prefetch-Control header and use the browser's default value:

app.use(
  helmet({
    xDnsPrefetchControl: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xDnsPrefetchControl()).

X-Download-Options

Default:

X-Download-Options: noopen

The X-Download-Options header is specific to Internet Explorer 8. It forces potentially-unsafe downloads to be saved, mitigating execution of HTML in your site's context. For more, see this old post on MSDN.

This header takes no options and is set by default.

// Sets "X-Download-Options: noopen"
app.use(helmet());

To disable the X-Download-Options header:

app.use(
  helmet({
    xDownloadOptions: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xDownloadOptions()).

X-Frame-Options

Default:

X-Frame-Options: SAMEORIGIN

The legacy X-Frame-Options header to help you mitigate clickjacking attacks. This header is superseded by the frame-ancestors Content Security Policy directive but is still useful on old browsers or if no CSP is used. For more, see the documentation on MDN.

// Sets "X-Frame-Options: SAMEORIGIN"
app.use(helmet());

action is a string that specifies which directive to use—either DENY or SAMEORIGIN. (A legacy directive, ALLOW-FROM, is not supported by Helmet. Read more here.) It defaults to SAMEORIGIN.

Examples:

// Sets "X-Frame-Options: DENY"
app.use(
  helmet({
    xFrameOptions: { action: "deny" },
  }),
);

// Sets "X-Frame-Options: SAMEORIGIN"
app.use(
  helmet({
    xFrameOptions: { action: "sameorigin" },
  }),
);

To disable the X-Frame-Options header:

app.use(
  helmet({
    xFrameOptions: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xFrameOptions()).

X-Permitted-Cross-Domain-Policies

Default:

X-Permitted-Cross-Domain-Policies: none

The X-Permitted-Cross-Domain-Policies header tells some clients (mostly Adobe products) your domain's policy for loading cross-domain content. See the description on OWASP for more.

// Sets "X-Permitted-Cross-Domain-Policies: none"
app.use(helmet());

permittedPolicies is a string that must be "none", "master-only", "by-content-type", or "all". It defaults to "none".

Examples:

// Sets "X-Permitted-Cross-Domain-Policies: none"
app.use(
  helmet({
    xPermittedCrossDomainPolicies: {
      permittedPolicies: "none",
    },
  }),
);

// Sets "X-Permitted-Cross-Domain-Policies: by-content-type"
app.use(
  helmet({
    xPermittedCrossDomainPolicies: {
      permittedPolicies: "by-content-type",
    },
  }),
);

To disable the X-Permitted-Cross-Domain-Policies header:

app.use(
  helmet({
    xPermittedCrossDomainPolicies: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xPermittedCrossDomainPolicies()).

X-Powered-By

Default: the X-Powered-By header, if present, is removed.

Helmet removes the X-Powered-By header, which is set by default in Express and some other frameworks. Removing the header offers very limited security benefits (see this discussion) and is mostly removed to save bandwidth, but may thwart simplistic attackers.

Note: Express has a built-in way to disable the X-Powered-By header, which you may wish to use instead.

The removal of this header takes no options. The header is removed by default.

To disable this behavior:

// Not required, but recommended for Express users:
app.disable("x-powered-by");

// Ask Helmet to ignore the X-Powered-By header.
app.use(
  helmet({
    xPoweredBy: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xPoweredBy()).

X-XSS-Protection

Default:

X-XSS-Protection: 0

Helmet disables browsers' buggy cross-site scripting filter by setting the legacy X-XSS-Protection header to 0. See discussion about disabling the header here and documentation on MDN.

This header takes no options and is set by default.

To disable the X-XSS-Protection header:

// This is not recommended.
app.use(
  helmet({
    xXssProtection: false,
  }),
);

You can use this as standalone middleware with app.use(helmet.xXssProtection()).

helmet's Issues

helmet with connect (not express)

Hello,

I added helmet to my connect-based app and having an issue with it:

TypeError: Object #<ServerResponse> has no method 'header'
    at Object.handle (/.../helmet/lib/middleware/csp.js:26:17)
    at next (/.../node_modules/connect/lib/proto.js:193:15)

My configuration:

    var app = connect()
    .use( connect.static( pr.pathTo(global.codePath, 'dist/www') ) )
    .use( connect.query() )
    .use( connect.cookieParser() )
    .use( connect.session( { ... } ) )
    .use( connect.urlencoded() )
    .use( connect.json() )
    .use( connect.csrf() )
    .use( helmet.csp() );

Any help is much appreciated.

Add more CSP resources to README

Per #66, we should add some more resources for CSP.

HSTS never inserted with Connect.js middleware

Connect 3.0.x has no attribute .secure, e.g. req.secure is undefined. Thus
if (req.secure || req.headers['x-forwarded-proto'] == 'https') { in hsts.js evaluates always false and no HSTS header is ever added.

Looking through RFC6797, I am unsure if we could simply drop this test altogether, as browsers appear to ignore HSTS when there is no secure connection?

Add some CSP pre-configured options

Something like this might be cool:

app.use(helmet.csp.sslOnly());
app.use(helmet.csp.socialMedia());

I'd love some way to add these to policies, rather than overwrite them. Ideas?

Move xframe middleware into its own module

Send IE headers only on User-Agent match?

Wondering what people's thoughts are on checking the user agent in some of the IE-specific options to avoid "header clutter"?

Downsides I see are:

• misses users who've misconfigured their UA string
• we miss out until we update should other browsers gain support (e.g. the discussion on #26 seems to indicate this happens)

Upsides is just keeping the headers minimal, which probably only mildly OCD people care about but…well…here I am…

X-Powered-By GET /favicon.ico

Because I'm using chrome, this browser want to get the favicon.ico by a second GET. And this GET header containing X-Powered-By: Express.

Make helmets.defaults into middleware?

Any reason why helmets.defaults isn't middleware?

Helmet only works with Express, not Connect

Should just be a matter of calling res.setHeader instead of res.header.

Unsafe-Eval listed but still blocked

I have these policies:

    var policy = {
        defaultPolicy: {
            'default-src': [
                "'self'",
                "data:",
                "'unsafe-inline'",
                "'unsafe-eval'"
            ],
            'img-src': [
                "'self'",
                "data:",
                "www.google-analytics.com"
            ],
            'script-src': [
                "'self'",
                "'unsafe-inline'",
                "'unsafe-eval'",
                "www.google-analytics.com"
            ]
        }
    };

    helmet.csp.policy(policy);

    app.use(helmet.csp());

but still, Firefox complains with:

---

Content Security Policy: The page's settings blocked the loading of a resource: An attempt to call JavaScript from a string (by calling a function like eval) has been blocked

call to eval() or related function blocked by CSP

---

Huh? I am allowing unsafe-evals here. Can anyone explain?

Move HSTS middleware into its own module

Test Safari CSP

Move nosniff into its own middleware

CSP config problem with Google fonts

I have my font-src configured as follows:

HTML:

<link rel="stylesheet" href="//fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,300,400,500,700">

Helmet:

    fontSrc: [
        "'self'",
        'fonts.googleapis.com',
        'themes.googleusercontent.com'
    ]

but I am getting this error in the console:

Refused to load the font 'https://fonts.gstatic.com/s/opensans/v9/DXI1ORHCpsQm3Vp6mXoaTRampu5_7CjHW5spxoeN3Vs.woff2' because it violates the following Content Security Policy directive: "font-src 'self' fonts.googleapis.com themes.googleusercontent.com".

Can someone tell me what I am doing wrong? Thanks

Move ienoopen into its own module

Add cross domain meta policy

https://securityheaders.com/cross-domain-meta-policy.php

Test IE-specific CSP

Move nocache into its own middleware

helmet.defaults(app, { cacheControl: false });

that does not make a difference to caching behaviour, neither before nor after
app.use(helmet.defaults());
i would like to include the defaults but i want caching to be enabled, removing the helmet.defaults() caching behaviour is like expected, maybe im implementing wrong? but i could not find a better explanation in the documentation.

npm package looks old

Hello,

I installed the helmet library with the following command

npm instlal helmet

However, I seemed to get the previous version of helmet (version 0.1.3), and it didn't work for me. The latest one might be 0.2.0, so I guess npm package is still old.

Could you update/publish the latest to npm?

I installed latest in the following, and it works fine.

npm instlal git://github.com/evilpacket/helmet.git

Kind Regards,

Rules are modified without being cloned, permanently mutating `options` object

The problem is in these two lines:
https://github.com/evilpacket/helmet/blob/master/lib/middleware/csp.js#L129
https://github.com/evilpacket/helmet/blob/master/lib/middleware/csp.js#L137

At both of those lines, policy[key] points to options[key] by reference. This modifies options for all future requests, and is not the desired behavior.

Chrome CSP

Hi I'm having some problem with Chrome's CSP reporting. Here's the problem.

http://stackoverflow.com/questions/24067612/chrome-content-security-policy-reporting-csp-reporting-is-not-reporting

The request is failing. However for Firefox the reporting is good and I receive a 200. Wondering if the headers for chrome are not correct?

X-Webkit-CSP deprecated

I get this message with Chrome:

The 'X-WebKit-CSP' headers are deprecated; please consider using the canonical 'Content-Security-Policy' header instead.

Consider incorporating/endorsing express-enforces-ssl

The express-enforces-ssl module does a 301 redirect for HTTP connections to HTTPS connections. Maybe we should incorporate it or mention it in the README.

[xframe.js:12] TypeError: Cannot call method 'toUpperCase' of undefined

Got this error after update from 0.0.7 to 0.0.8:

/Users/jaxon/github/eom/node_modules/helmet/lib/middleware/xframe.js:12
    action = action.toUpperCase();
                    ^
TypeError: Cannot call method 'toUpperCase' of undefined

Reverting back to 0.0.7 resolved the issue.

More complete log:

Air-2:eom jaxon$ node ./server.js

/Users/jaxon/github/eom/node_modules/helmet/lib/middleware/xframe.js:12
    action = action.toUpperCase();
                    ^
TypeError: Cannot call method 'toUpperCase' of undefined
    at Object.module.exports (/Users/jaxon/github/eom/node_modules/helmet/lib/middleware/xframe.js:12:21)
    at Function.<anonymous> (/Users/jaxon/github/eom/settings.js:102:20)
    at Function.app.configure (/Users/jaxon/github/eom/node_modules/express/lib/application.js:395:61)
    at bootApplication (/Users/jaxon/github/eom/settings.js:31:7)
    at Object.exports.boot (/Users/jaxon/github/eom/settings.js:10:3)
    at Object.<anonymous> (/Users/jaxon/github/eom/server.js:65:23)
    at Module._compile (module.js:449:26)
    at Object.Module._extensions..js (module.js:467:10)
    at Module.load (module.js:356:32)
    at Function.Module._load (module.js:312:12)

Add tests for HSTS

Consider making better CSP keys for options

What if you could set your CSP like this:

app.use(helmet.csp({
  defaultSrc: [ /* ... */ ],
  reportUri: [ /* ... */ ]
}))

Would this be a welcome feature?

Security.MD

I saw your talk, just curious why it isn't in this project.

Security audit csp.reporter

I think it has vulnerabilities...

Add/recommend rate-limiting middleware

I'd love this:

app.use(helmet.rateLimit({
  rate: 500,     // 500 requests allowed every...
  window: 50000, // ...50 seconds
  whitelist: ["127.0.0.1"]
});

Could be included by default.

Fix CSP + CSRF docs

Thanks for noticing, @fkammer!

Test Chrome Mobile CSP

Move xssFilter into its own module

Throw an error for CSP if reportOnly is true without a report-uri

This should throw an error:

helmet.csp({
  reportOnly: true,
  'report-uri': null
});

Implement x-content-type-options?

Look into implementing x-content-type-options

http://blogs.msdn.com/b/ie/archive/2010/10/26/mime-handling-changes-in-internet-explorer.aspx

Test Chrome CSP

Add CORS middleware

Probably disabled or does nothing by default, but you could open up some CORS stuff.

CSP mw throws TypeError on Firefox < v23 with specific CSP config

STEPS TO REPRODUCE:

• Use CSP middleware with any of the optional reportOnly, setAllHeaders, or safari5 config options
• Hit the page on older Firefox, specifically version < 23

RESULTS:

• Get a TypeError:

Stack:  TypeError: Object false has no method 'indexOf'
    at /my_project/node_modules/helmet/lib/middleware/csp.js:125:50
    at Array.forEach (native)
    at csp (/my_project/node_modules/helmet/lib/middleware/csp.js:108:42)
    ....

Problem is that this line:
https://github.com/evilpacket/helmet/blob/master/lib/middleware/csp.js#L108

iterates over the config options then sets special headers if different things are present for older firefox.

If you include any of the boolean config options -- reportOnly, setAllHeaders, or safari5 -- then https://github.com/evilpacket/helmet/blob/master/lib/middleware/csp.js#L125 tries an indexOf against the boolean, which of course fails.

IE XSS filter can be used for XSS attacks instead of preventing it.

There used to a bug in the XSS filters in Internet Explorer which actually enabled XSS attacks instead of preventing it. Making sites which would normally be safe vulnerable for attacks.

So helmet could actually make sites more vulnerable instead of protecting them. The simplest solution would be disabling the filter for IE8 as this fix was most certainly landed in IE9 > as I doubt it can be detected by UA sniffing. If you feel it's not worth to fix this.. Please consider adding a note to the README file so developers know that they potentially expose them selfs to XSS attacks.

Related reading:
http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/
http://technet.microsoft.com/en-us/security/bulletin/MS10-002

Add tests for CSP

Impossible to disable sandbox for CSP header in IE

Steps:
Use the CSP middleware like this: app.use(helmet.csp({}));
Open the page with IE10 and check headers

Expected:
No content security policy headers

Actual:

This line of code is at fault -- why is it there?: https://github.com/evilpacket/helmet/blob/a1d7d10bfd43e55db008d44c08259b8d9f459ed3/lib/middleware/csp.js#L91

Sandbox in IE has the unfortunate side-affect of disabling forms.

Move hidePoweredBy middleware into its own module

Problem with iPad Safari and https ?

In my app, I have the following policy:

helmet.csp.policy
defaultPolicy:
"img-src" : ['*']
"style-src" : ["'self'", "'unsafe-inline'", "fonts.googleapis.com"]
"script-src" : ["'self'", "cdnjs.cloudflare.com", "login.persona.org", "ajax.googleapis.com", "www.google-analytics.com"]

This works well for all OS/browser combinations I'm testing, except for mobile Safari on the iPad which refuses to load the script from https://login.persona.org/include.js

The persona script is the only one delivered through https protocol. Maybe this has something to do with this ?

Deprecated Warning

Hi there

In Firebug I see this:

The X-Content-Security-Policy and X-Content-Security-Report-Only headers will be deprecated in the future. Please use the Content-Security-Policy and Content-Security-Report-Only headers with CSP spec compliant syntax instead.

Why?

helmet.hsts() doesn't send correctly formed max-age directive

When sending the Strict-Transport-Security header, helmet sets the max-age directive to maxAge=15768000. According to the spec it should be max-age=15768000: http://tools.ietf.org/html/rfc6797#section-6.1.1

Move CSP middleware to helmet-csp

See helmetjs/csp.

post to reportUri: ['/report-violation'] with csrf enabled??

I get 403's now of course. Any ideas or is this just not possible?

Handle bad input

Let's say I did something like this:

app.use(helmet.xframe('same-origin'));

That's a mistake -- it should be 'sameorigin'. At the moment, that mistake will be as if I typed DENY.

Should an error be thrown in that case? I think so, but it's debatable.

I know error checking isn't a JavaScript idiom, but I think this could be very helpful.

How about a version bump and push to npm?

npmjs.org has v0.1.2 which is quite outdated, and does not work in Connect.js without patches. Also, the CSP headers etc. have been updated, for ex. Chrome browsers now get actionable headers (not X-...).

Discussion: How would you recommend configuring Helmet for a RESTful JSON API (sessionless) secured by oAuth bearer tokens?

I am endeavouring to put together a comprehensive CRUD prototype which you can find at https://github.com/jlchereau/Phonegap.Express.

I am not a security expert but I have been recommended to add Helmet to the stack.

How would you recommend configuring Helmet for a RESTful JSON API (sessionless) secured by oAuth bearer tokens?