@rtorcato/api-security-express

Express security-headers middleware — a thin helmet wrapper that applies its full, sane default header suite under the @rtorcato/api-* naming.

Hono ships secureHeaders built in, so this adapter is Express-only.

Install

pnpm add @rtorcato/api-security-express

Usage

import { securityMiddleware } from '@rtorcato/api-security-express'

// helmet's secure defaults.
app.use(securityMiddleware())

// Serving HTML with a custom Content-Security-Policy? Pass helmet options through.
app.use(securityMiddleware({
  contentSecurityPolicy: { directives: { 'script-src': ["'self'"] } },
}))

Called with no arguments, it applies helmet's full default suite: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy, Strict-Transport-Security, a default Content-Security-Policy, and more. Any helmet option you pass is forwarded verbatim.

express is a peer dependency (v4 or v5) — you control the version.

License

MIT