require-csp-headers

Quick Summary

Aspect	Details
Severity	Medium (XSS Mitigation)
Auto-Fix	❌ No (requires policy definition)
Category	Security
ESLint MCP	✅ Optimized for ESLint MCP integration
Best For	Web servers serving HTML content
Suggestions	✅ Advice on using Helmet for standard policies

Vulnerability and Risk

Vulnerability: A missing or weak Content Security Policy (CSP) leaves an application vulnerable to Cross-Site Scripting (XSS), clickjacking, and data injection attacks.

Risk: Without a CSP, the browser has no way of knowing if a script running on the page is legitimate or has been injected by an attacker. A successful XSS attack can lead to session theft, credential harvesting, and defacement.

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-1021 OWASP:M8 | Missing CSP detected | MEDIUM [XSS Mitigation]
   Fix: Use helmet.contentSecurityPolicy() or set CSP header manually | https://cwe.mitre.org/data/definitions/1021.html

Message Components

Component	Purpose	Example
Risk Standards	Security benchmarks	CWE-1021 OWASP:M8
Issue Description	Specific vulnerability	`Missing CSP detected`
Severity & Compliance	Impact assessment	`MEDIUM [XSS Mitigation]`
Fix Instruction	Actionable remediation	`Use helmet.contentSecurityPolicy()`
Technical Truth	Official reference	Improper Restriction

Rule Details

This rule flags Express response methods like res.render() or res.send() when they appear to be sending HTML content without a corresponding CSP header being configured.

Why This Matters

Issue	Impact	Solution
🕵️ XSS	Session theft and data leakage	Define strict `script-src` and `object-src`
🚀 Exfiltration	Stealing data to external sites	Use `connect-src` to restrict outgoing requests
🤝 Trust	Site used for phishing	Use `frame-ancestors` to prevent clickjacking

Options

Option	Type	Default	Description
`responseReceivers`	`string[]`	`["res","response","reply"]`	Identifiers that name a response object, so `<name>.render(view)` emits a response rather than returning a string. Anything unlisted is treated as a template engine.

<name>.render(view) is only a response emission when <name> is a response object. nunjucksEnv.render(template, data) returns a string, and so do mustache, ejs, handlebars and ReactDOMServer — none of them can set an HTTP header, so demanding a CSP at those call sites is a finding nobody can action.

Setting this replaces the default list rather than extending it, so a codebase whose handlers name the response something else lists every name it uses:

{
  "rules": {
    "browser-security/require-csp-headers": [
      "error",
      { "responseReceivers": ["res", "response", "reply", "httpRes"] }
    ]
  }
}

The rule also skips test files: rendering a template to assert on its markup is not a route serving a document.

Examples

❌ Incorrect

// Sending HTML directly without CSP headers
app.get('/', (req, res) => {
  res.send('<!DOCTYPE html><html><body><h1>Hello World</h1></body></html>');
});

// Rendering a view without global CSP middleware
app.get('/home', (req, res) => {
  res.render('index', { title: 'Home' });
});

✅ Correct

res.send({ data: 'json' });