Helmet.js

Conditionally skipping headers

To skip a header conditionally, create your own small middleware function that conditionally calls different invocations of Helmet.

For example, you could decide to conditionally enable a Content Security Policy for a subset of users. Here’s how that could look:

const helmetWithCsp = helmet()
const helmetWithoutCsp = helmet({contentSecurityPolicy:false})

app.use((req, res, next) => {
  if (req.user.isContentSecurityPolicyEnabled) {
    helmetWithCsp(req,res,next)
  } else {
    helmetWithoutCsp(req,res,next)
  }
});