Helmet.js

See also

Helmet only deals with HTTP headers, but there are a number of other helpful security modules for Express. As a disclaimer, Helmet’s maintainers have not heavily audited these modules!

• cors
• express-content-length-validator
• express-enforces-ssl
• hpp
• host-validation

This module also exists in other environments. Some are direct ports where others are similar modules.

• ASP.NET: NWebsec
• Crystal: crystal-helmet
• Dart: shelf_helmet
• Django (Python framework): django-csp
• Dropwizard (Java framework): dropwizard-web-security
• Elixir: SecureHeaders
• Ember.js (JavaScript framework): ember-cli-content-security-policy
• Fastify (Node framework): fastify-helmet
• Flask (Python framework): Talisman
• Go: secure; secureheader
• Hapi (Node framework): blankie
• Koa (Node framework): koa-helmet
• PHP: Secure Headers
• Ring (Clojure framework): ring-secure-headers
• Ruby (and Rails): Secure Headers; rack-secure_headers

There are also other modules like Helmet for Node if you don’t like us:

• hood
• lusca

And finally, if you would rather not use Helmet, see this guide which shows how to accomplish what Helmet does without installing anything new.