Helmet for security headers in Node.js

Introduction

Helmet helps keep your web app safe by adding special security headers. These headers tell browsers how to handle your site safely.

When you want to protect your website from common security risks like clickjacking or cross-site scripting.

When you are building a Node.js web server using Express and want easy security improvements.

When you want to control what resources browsers can load on your site.

When you want to add security headers without writing them manually.

When you want to improve your site's security with minimal setup.

Syntax

Node.js

import helmet from 'helmet';
import express from 'express';

const app = express();
app.use(helmet());

Use helmet() as middleware in your Express app to add default security headers.

You can customize Helmet by enabling or disabling specific headers.

Examples

Basic use: adds many security headers with default settings.

Node.js

import helmet from 'helmet';
import express from 'express';

const app = express();
app.use(helmet());

Customize Content Security Policy to allow images only from your site and images.com.

Node.js

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    imgSrc: ["'self'", 'images.com']
  }
}));

Remove the 'X-Powered-By' header to hide server info.

Node.js

app.use(helmet.hidePoweredBy());

Sample Program

This simple Express server uses Helmet to add security headers automatically. When you visit the homepage, it shows a greeting message.

Node.js

import express from 'express';
import helmet from 'helmet';

const app = express();

// Use Helmet to add security headers
app.use(helmet());

app.get('/', (req, res) => {
  res.send('Hello, secure world!');
});

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

Important Notes

Helmet sets many headers by default, but you can customize or disable them as needed.

Always test your site after adding Helmet to ensure no features break due to strict headers.

Helmet helps protect against common attacks but does not replace other security practices.

Summary

Helmet adds security headers easily to your Node.js Express app.

It helps protect your site from common web attacks.

You can customize which headers to use for your needs.