express-security-policy

A lightweight Express.js middleware for implementing organizational security policies. This package provides a centralized source for core security headers including Content Security Policy (CSP), HSTS, and X-Frame-Options.

Features

• Header Enforcement: Automatically injects standard security headers into the response.
• Customizable: Optional configuration for specific environment requirements.
• Zero Dependency: Lightweight and fast, designed for high-performance production environments.

Installation

npm install express-security-policy

Usage

const express = require('express');
const security = require('express-security-policy');
const app = express();

// Apply standard security policy
app.use(security());

app.listen(3000);

Security Headers

By default, this middleware sets:

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY

License

MIT (c) 2026 Enterprise Security Team