felid-helmet

Using Helmet middlewares in your Felid app to help improving security.

Install

npm install felid-helmet

or

yarn add felid-helmet

Usage

const Felid = require('felid')
const helmet = require('felid-helmet')

const app = new Felid()
app.plugin(helmet, options)

The following table displays all middlewares in Helmet, and the default ones. (Data comes from Helmet's doc)

| Module | Default? | |---|---| | contentSecurityPolicy for setting Content Security Policy | | | crossdomain for handling Adobe products' crossdomain requests | | | dnsPrefetchControl controls browser DNS prefetching | ✓ | | expectCt for handling Certificate Transparency | | | featurePolicy to limit your site's features | | | frameguard to prevent clickjacking | ✓ | | hidePoweredBy to remove the X-Powered-By header | ✓ | | hpkp for HTTP Public Key Pinning | | | hsts for HTTP Strict Transport Security | ✓ | | ieNoOpen sets X-Download-Options for IE8+ | ✓ | | noCache to disable client-side caching | | | noSniff to keep clients from sniffing the MIME type | ✓ | | referrerPolicy to hide the Referer header | | | xssFilter adds some small XSS protections | ✓ |

Pass an option to the middleware:

app.use(helmet, {
  xssFilter: { mode: null }
})

Disable a default middleware:

app.use(helmet, { xssFilter: false })

To enable a middleware, you can set the property to true (and use the default option), or just pass the option to it.

app.use(helmet, {
  expectCt: { maxAge: 123 },
  hpkp: true
})

For more information, please check the official documentation of Helmet.

License

MIT