Why do you need Helmet in NodeJs ?

#node #webdev #codenewbie #javascript

Helmet helps you secure your Express apps by setting various HTTP headers. It's not a silver bullet, but it can help!

These are the lines written on top of the npm's helmet page.

Most of you might have come across this code app.use(helmet()) in your codebase/boilerplates. Let's dive deep into helmet today.

In simple words, Helmet adds/secures HTTP headers returned by your express app.

Most of the newbie devs tend to ignore this (secured HTTP headers).

helmet() is a wrapper around 15 middlewares, 11 of them are used by default with preset settings.

Let's see those 11 headers in detail:

Content-Security-Policy

Used for mitigating XSS Attacks. Helps control what domain/subdomain, which protocol, what kind of media should talk to the server.
helmet.contentSecurityPolicy();
X-DNS-Prefetch-Control

As the name of this header suggests, the browser tries to resolve DNS while (in parallel) loading the page content. DNS resolution for what? - For the links, images, etc referenced on the page which is being loaded. Prefetching occurs in the background. Helps reduce latency. By default, helmet sets this as off.
helmet.dnsPrefetchControl(options)
Expect-CT

CT in this header stands for Certificate Transparency. Catch that misissued certificate on that site.
helmet.expectCt()
X-Frame-Options

A well-known header to prevent clickjacking up to a certain extent. Gets overridden by frame-ancestors directive of Content Security Policy header.
helmet.frameguard();
X-Powered-By

This headers makes very less difference even if turned off. Set to express by default in Express framework.
helmet.hidePoweredBy()
Strict-Transport-Security

or HSTS in short, tells browsers that the website should only be accessible via HTTP(S) protocol. No HTTP please! Takes one mandatory param max-age (which is 180 days in helmet) and 2 optional params includeSubDomains (defaults to true) & preload (defaults to false) in options.
helmet.hsts(options)
X-Download-Options

Specific to Internet Explorer, this header forces potentially unsafe files and instead downloads them directly, thus preventing script injections since the file is no longer opened in the security context of the site.
helmet.ieNoOpen()
X-Content-Type-Options

helmet.noSniff sets the X-Content-Type-Options header to nosniff. Browsers in some cases try to guess the MIME types by looking at bytes of resources shared by the server. Hey Browser! Don't do that. That's MIME sniffing. Let me give you a nosniff in the Content Type Options.
helmet.noSniff()
X-Permitted-Cross-Domain-Policies

Ah! That's a little tricky. Check this article for a detailed description.
helmet.permittedCrossDomainPolicies(options)
Referrer-Policy

Server dictates what all referrer information it needs in the Referer (Oh yeah! That's a misspell) header via Referrer-Policy header. It defaults to no-referrer in case of using helmet.
helmet.referrerPolicy(options)
X-XSS-Protection

Oh, Stop! I detected an xss attack.
If it's 0 - Disables XSS filtering.
If it's 1 - Enables XSS filtering. sanitize and then load if XSS is detected.
If it's 1; mode=block - Enables XSS filtering. Do not sanitize, just stop the rendering altogether.
helmet.xssFilter()

So that was all about the 11 default headers Helmet sets. A snippet from Helmet's NPM Page:

Top comments (4)

Joe Honton • May 12 '21

Only 4 of these are standard HTTP headers.

The Content-Security-Policy and Referrer-Policy are keepers, but if you're serious about them, why not study the possible values they supports, and set them explicitly?

developer.mozilla.org/en-US/docs/W...

The Strict-Transport-Security header is not necessary -- simply firewall port 80 and serve your website on port 443 with a valid TLS certificate.

The Expect-CT header is obsolete as of June 2021
developer.mozilla.org/en-US/docs/W...

All the rest are non-standard "X-" headers that should be used only when you explictly need them.

My point is that simply adding a call to helmet() will delay your learning of HTTP.