helmet

Helmet is a collection of Express middleware functions that set security-related HTTP response headers to help protect your app from a range of well-known web vulnerabilities. Calling helmet() applies sensible defaults for roughly a dozen headers, including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and Cross-Origin-Resource-Policy.

Each header is implemented as its own standalone middleware, so you can enable the full bundle, disable individual headers, or fine-tune any of them with header-specific options. Helmet aims to be quick to integrate and low maintenance afterward, making it a common baseline for hardening Node.js web servers.

What You Get

• A one-line helmet() middleware that sets around a dozen protective HTTP response headers with sensible defaults.
• Individually configurable headers, each of which can be disabled or tuned via a dedicated options object.
• Standalone middleware exports (e.g. helmet.contentSecurityPolicy()) so you can apply a single header on its own.
• First-class TypeScript types for every header’s options, with descriptive runtime errors for misconfiguration.

Common Use Cases

• Hardening an Express API or web app against common attacks by applying a security-header baseline.
• Defining and enforcing a Content-Security-Policy to mitigate cross-site scripting and injection.
• Enforcing HTTPS with Strict-Transport-Security (HSTS) across a domain and its subdomains.
• Controlling cross-origin resource, opener, and embedder behavior for process isolation and resource protection.

Under The Hood

Architecture — Helmet is organized as a thin composition layer over a set of independent middleware modules. The middlewares/ directory holds one folder per header (content-security-policy, strict-transport-security, referrer-policy, cross-origin-*, x-frame-options, and so on), each exporting a default middleware factory plus its own options type. The root index.ts imports every factory, defines a combined HelmetOptions type that maps each key to either the header’s options or a boolean, and returns a single middleware that instantiates the enabled sub-middlewares once at startup and invokes them per request. Legacy aliases (e.g. hsts, frameguard, noSniff) are supported through a TypeScript EitherKey helper that prevents passing both the modern and legacy name at once.

Tech Stack — The library is written in TypeScript (95% of the codebase) targeting Node.js >=18 and ships as an ES module with no runtime dependencies. The build is driven by a custom build/build-package.ts script run through tsx on top of Rollup with @rollup/plugin-typescript and rollup-plugin-dts to emit JavaScript plus bundled type declarations. Tooling includes ESLint (typescript-eslint), Prettier, and tsc --noEmit for type checking.

Code Quality — Test coverage is thorough: the test/ directory contains a dedicated .test.ts suite per middleware plus an aggregate index.test.ts, run with Node’s built-in test runner via tsx --test and supertest for HTTP assertions. Individual middlewares perform careful input validation, throwing clear, actionable error messages for common mistakes (for example, catching the maxage vs maxAge and includeSubdomains vs includeSubDomains casing errors in the HSTS middleware). Strict typing and consistent naming run throughout.

API Design — The public API is deliberately minimal and ergonomic: app.use(helmet()) is enough to get a strong default posture, and every header can be turned off with false or customized with a typed options object using either camelCase or kebab-case directive keys. Each header is also exposed as a standalone middleware for granular use. Documentation is excellent, with a detailed README covering every header, an official docs site, and an FAQ.