Variable helmetOptions`Const`

helmetOptions: {
    contentSecurityPolicy: {
        directives: {
            defaultSrc: string[];
            styleSrc: string[];
            scriptSrc: string[];
            imgSrc: string[];
            connectSrc: string[];
            fontSrc: string[];
            objectSrc: string[];
            mediaSrc: string[];
            frameSrc: string[];
        };
    };
    crossOriginEmbedderPolicy: boolean;
    hsts: { maxAge: number; includeSubDomains: boolean; preload: boolean };
} = ...

Configuration object for Helmet security middleware

Type declaration

contentSecurityPolicy: {
    directives: {
        defaultSrc: string[];
        styleSrc: string[];
        scriptSrc: string[];
        imgSrc: string[];
        connectSrc: string[];
        fontSrc: string[];
        objectSrc: string[];
        mediaSrc: string[];
        frameSrc: string[];
    };
}
crossOriginEmbedderPolicy: boolean
hsts: { maxAge: number; includeSubDomains: boolean; preload: boolean }

Example

// Usage with Helmet middleware in main application
import helmet from 'helmet';
import { helmetOptions } from '@/shared/middleware/security';

app.use(helmet(helmetOptions));

Example

// Headers set by this configuration:
// Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://unpkg.com/swagger-ui-dist@5.9.0/; script-src 'self' 'unsafe-inline' https://unpkg.com/swagger-ui-dist@5.9.0/; ...
// Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
// X-Content-Type-Options: nosniff
// X-Frame-Options: DENY
// X-XSS-Protection: 1; mode=block

Variable helmetOptionsConst

Type declaration

contentSecurityPolicy: { directives: { defaultSrc: string[]; styleSrc: string[]; scriptSrc: string[]; imgSrc: string[]; connectSrc: string[]; fontSrc: string[]; objectSrc: string[]; mediaSrc: string[]; frameSrc: string[]; };}

crossOriginEmbedderPolicy: boolean

hsts: { maxAge: number; includeSubDomains: boolean; preload: boolean }

Example

Example

Settings

Variable helmetOptions`Const`

contentSecurityPolicy: {
directives: {
defaultSrc: string[];
styleSrc: string[];
scriptSrc: string[];
imgSrc: string[];
connectSrc: string[];
fontSrc: string[];
objectSrc: string[];
mediaSrc: string[];
frameSrc: string[];
};
}