helmet-permitted-cross-domain-policies

helmet-permitted-cross-domain-policies is a small but reusable middleware SDK for applying the X-Permitted-Cross-Domain-Policies response header in Express apps, internal Node.js frameworks, and shared platform packages.

Instead of shipping a single inline middleware function, this package is organized into reusable modules so developers can consume only what they need.

What developers get

• Express-compatible middleware
• Plain response helper for custom frameworks
• Normalized policy parsing and validation
• zod-based options parsing
• Safe setIfAbsent support for layered middleware stacks

Installation

npm install helmet-permitted-cross-domain-policies

Package structure

helmet-permitted-cross-domain-policies/
├── index.js
├── src/
│   ├── constants.js
│   ├── helpers.js
│   ├── index.js
│   ├── middleware.js
│   └── validation.js
└── test.js

Quick start

Express

const express = require('express');
const permittedCrossDomainPolicies = require('helmet-permitted-cross-domain-policies');

const app = express();

app.use(permittedCrossDomainPolicies());

Shared security preset

const permittedCrossDomainPolicies = require('helmet-permitted-cross-domain-policies');

function attachSecurityHeaders(app) {
  app.use(
    permittedCrossDomainPolicies({
      permittedPolicies: 'none',
      setIfAbsent: true,
    })
  );
}

module.exports = { attachSecurityHeaders };

Plain Node.js

const http = require('http');
const { applyHeader } = require('helmet-permitted-cross-domain-policies');

const server = http.createServer((req, res) => {
  applyHeader(res, 'by-content-type');
  res.end('policy header applied');
});

API reference

permittedCrossDomainPolicies(options?)

Returns Express-compatible middleware.

app.use(
  permittedCrossDomainPolicies({
    permittedPolicies: 'master-only',
    setIfAbsent: true,
  })
);

Options:

| Option | Default | Description | | --- | --- | --- | | permittedPolicies | 'none' | Header value to set | | setIfAbsent | false | Leaves an existing header untouched |

You can also pass a policy string directly:

app.use(permittedCrossDomainPolicies('master-only'));

applyHeader(res, policy?, options?)

Sets the header on any response-like object that exposes setHeader().

applyHeader(res, 'none');
applyHeader(res, 'master-only', { setIfAbsent: true });

buildHeaderValue(policy?)

Validates and normalizes a policy string.

const headerValue = buildHeaderValue('Master-Only');
// 'master-only'

parsePolicy(value)

Returns the normalized policy string or null.

isValidPolicy(value)

Returns true when the supplied value is supported.

Exported constants

• HEADER_NAME
• DEFAULT_POLICY
• VALID_POLICIES

Supported policy values

| Value | Meaning | | --- | --- | | none | Disallow policy files | | master-only | Allow only the master policy file | | by-content-type | Allow only correctly served policy files | | by-ftp-filename | Allow only crossdomain.xml for FTP | | all | Allow all policy files |

When to use this package

This package is useful when you are:

• building a shared Express starter
• standardizing response headers across services
• wrapping security defaults in an internal SDK
• avoiding repeated header validation logic in multiple repositories

License

This package is licensed under the MIT License. See LICENSE.