Skip to content
Back to Stack Recommender

Helmet

Helmet — Express middleware for setting security HTTP headers.

SecuritySimple

Stack Components

MiddlewareHelmet 8.x

Why

Sets X-Frame-Options, CSP, HSTS, X-Content-Type-Options in one call. Verizon DBIR 2024: 68% of breaches involve human error.

Snyk and Dependabot scan 500k+ npm packages for CVEs, and OWASP Top 10 hasn't changed much — injection and broken auth remain #1 and #2.

When

Use for Express/Connect apps. Avoid for non-HTTP servers.

How

1. npm install helmet 2. app.use(helmet()) 3. Configure specific headers 4. Test with securityheaders.com

Example

import helmet from 'helmet'; app.use(helmet({ contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } }, }));

Common Problems

  • ⚠CSP breaking inline scripts — use nonces
  • ⚠HSTS in dev — disable in development
  • ⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical

Best Practices

  • ✓Enable all defaults
  • ✓Customize CSP per route
  • ✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit

FAQ

What is Helmet and what projects is it for?

Helmet — Express middleware for setting security HTTP headers. It pairs layered technologies for end-to-end type safety and out-of-the-box deploys, fitting everything from MVPs to production SaaS.

How do I spin up a working demo with Helmet in 10 minutes?

Two steps: (1) npm install helmet; (2) app.use(helmet()). Get the local dev server running, then wire one real data source to verify the end-to-end loop.

What is the most common pitfall with Helmet and how do I avoid it?

The most common pitfall is: CSP breaking inline scripts — use nonces. Avoid it by adding the matching checklist to your PR template and running type-check + lint + unit tests in CI — three gates before merge.

What are the best practices for Helmet?

Best practices for Helmet include: Enable all defaults; Customize CSP per route; Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit. The first one — "Enable all defaults" — should be set up at project init to avoid costly rework later.

When should I NOT choose Helmet?

Pick something else in three cases: (1) the team has zero experience with the core framework and the deadline is tight (learning-curve risk); (2) it's a pure content/marketing site (Astro is lighter); (3) you need very high throughput (>10k RPS) or strict-consistency microservices (Go/Rust). Helmet shines for mid-to-high complexity full-stack and API work — don't over-engineer simple static pages with it.