eslint-plugin-express-security

AI-Optimized Security

Every rule includes CWE, OWASP, and CVSS metadata for AI assistants to provide precise, context-aware fixes.

Install

npm install -D eslint-plugin-express-security

Rules (10)

Browse all Express.js security rules with CWE/OWASP mapping

Changelog

View version history and updates

Live from GitHub

This content is fetched directly from README.md on GitHub and cached for 1 hour.

Live README from GitHubfrom eslint-plugin-express-security/README.md, cached for 1 hour.Edit on GitHub

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Comprehensive security rules for Express.js applications, mapping to OWASP Top 10.

Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-express-security --save-dev

⚙️ Configuration Presets

Preset	Description
`recommended`	Balanced security for Express projects (critical as error, others warn)
`strict`	Maximum security enforcement (all rules as errors)
`api`	HTTP/API security rules only (CORS, CSRF, cookies, rate limiting)
`graphql`	GraphQL-specific security rules only

📚 Supported Libraries

Library	npm	Downloads	Detection
`express`			Misconfig, DoS
`helmet`			Missing Security Headers
`cors`			Permissive CORS
`csurf`			Missing CSRF Protection

📦 Compatibility

Package	Version
ESLint	`^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0`
Node.js	`>=18.0.0`

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

Icon	Description
💼	Recommended: Included in the recommended preset.
⚠️	Warns: Set to warn in recommended preset.
🔧	Auto-fixable: Automatically fixable by the `--fix` CLI option.
💡	Suggestions: Providing code suggestions in IDE.
🚫	Deprecated: This rule is deprecated.
🟢	Type-unaware: AST-only, runs in oxlint JS-plugin tier.
🟡	Type-aware (refining): pure-AST primary path; types refine precision.
🟠	Type-aware (graceful): requires TS program; silent without it.

Rule	CWE	OWASP	Description	🧠	💼	⚠️
no-client-controlled-authorization	CWE-863	A01:2021	This rule detects access decisions taken on request-supplied role, permission or identity values — the chec…	🟢		⚠️
no-cors-credentials-wildcard	CWE-942		The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢	💼
no-disabled-helmet-protections	CWE-693	A05:2021	This rule detects helmet options that switch a shipped security-header default off, leaving a mounted helme…	🟢	💼
no-error-details-in-response	CWE-209	A04:2021	Disallow sending caught error objects, stack traces, or spreads of them in HTTP responses.	🟢	💼
no-exposed-debug-endpoints	CWE-489	A05:2021	Identifies potential debug, administration, or testing endpoints that are often left exposed in production…	🟢	💼
no-express-unsafe-regex-route	CWE-1333		This rule detects Regular Expression Denial of Service (ReDoS) vulnerabilities in Express route patterns	🟢	💼
no-graphql-introspection-production	CWE-200		This rule detects GraphQL servers with introspection enabled in production	🟢		⚠️
no-host-header-in-links	CWE-640	A07:2021	Disallow building absolute URLs (password-reset and verification links) from the Host or X-Forwarded-Host r…	🟢	💼
no-idor-resource-access	CWE-639	A01:2021	This rule detects a resource fetched by an identifier taken straight from the request inside a handler that…	🟢		⚠️
no-insecure-cookie-options	CWE-614		The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢	💼
no-missing-cors-check	CWE-346		Detects missing CORS validation (wildcard CORS, missing origin check)	🟢
no-missing-csrf-protection	CWE-352		Detects missing CSRF token validation in POST/PUT/DELETE requests	🟢
no-missing-security-headers	CWE-693		Detects missing security headers in HTTP responses	🟢
no-permissive-cors	CWE-942		Detects overly permissive CORS configurations in Express.js applications	🟢	💼
no-permissive-trust-proxy	CWE-348	A05:2021	This rule detects unconditional 'trust proxy' settings, which make req.ip whatever the caller says it is an…	🟢	💼
no-sensitive-data-in-query	CWE-598	A04:2021	Disallow reading sensitive-named parameters (password, token, secret, apiKey, ...) from req.query.	🟢		⚠️
no-static-root-exposure	CWE-548	A05:2021	Disallow express.static() roots that expose the application directory and any serve-index usage	🟢	💼
no-unsafe-csp-directives	CWE-79	A03:2021	This rule detects Content-Security-Policy directives that hand back the protection the header exists to pro…	🟢	💼
no-user-controlled-redirect	CWE-601		Disallow res.redirect() with values directly from req.query / req.body / req.params	🟢	💼
no-user-controlled-render-locals	CWE-73	A03:2021	Disallow res.render() with locals or view names sourced wholesale from req.body / req.query / req.params	🟢	💼
require-case-insensitive-path-guard	CWE-178	A01:2021	This rule detects path-based authorization guards that compare req.path case-sensitively, which case-insens…	🟢		⚠️
require-csrf-protection	CWE-352		The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢		⚠️
require-express-body-parser-limits	CWE-400		The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢		⚠️
require-helmet	CWE-693		This rule detects Express.js applications that are missing the helmet middleware	🟢	💼
require-query-type-guard	CWE-843	A03:2021	This rule detects string methods called on req.query values without a type guard — Express query values can…	🟢		⚠️
require-rate-limiting	CWE-770		This rule detects Express.js applications missing rate-limiting middleware	🟢	💼
require-route-authentication	CWE-306	A07:2021	This rule detects routes that expose a critical function — credentials, accounts, payments, configuration —…	🟢		⚠️
require-strict-transport-security	CWE-319	A02:2021	This rule detects HSTS configurations that leave a downgrade window open — the header disabled, a max-age b…	🟢	💼

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
`eslint-plugin-anthropic-security`		Anthropic SDK security.
`eslint-plugin-browser-security`		XSS, DOM security.
`eslint-plugin-drizzle-security`		Drizzle security.
`eslint-plugin-gemini-security`		Google Gemini SDK security.
`eslint-plugin-jwt-security`		Token security.
`eslint-plugin-knex-security`		Knex security.
`eslint-plugin-lambda-security`		AWS Lambda hardening.
`eslint-plugin-mcp-sdk-security`		MCP SDK security.
`eslint-plugin-mongodb-security`		MongoDB injection.
`eslint-plugin-mysql-security`		MySQL security.
`eslint-plugin-nestjs-security`		NestJS framework hardening.
`eslint-plugin-node-security`		Server-side patterns.
`eslint-plugin-openai-security`		OpenAI SDK security.
`eslint-plugin-postgresql-security`		PostgreSQL security.
`eslint-plugin-prisma-security`		Prisma security.
`eslint-plugin-secure-coding`		Injection prevention.
`eslint-plugin-sequelize-security`		Sequelize ORM security.
`eslint-plugin-sqlite-security`		SQLite security.
`eslint-plugin-supabase-security`		Supabase security.
`eslint-plugin-typeorm-security`		TypeORM security.
`eslint-plugin-vercel-ai-security`		AI SDK security.

Code quality

Plugin	Downloads	Description
`eslint-plugin-conventions`		Team-specific habits and styles.
`eslint-plugin-import-next`		Fast cycle + import-graph analysis.
`eslint-plugin-maintainability`		Cognitive load and clean-code patterns.
`eslint-plugin-modernization`		ESNext migration + syntax evolution.
`eslint-plugin-modularity`		Structural integrity and DDD patterns.
`eslint-plugin-operability`		Production readiness and resource health.
`eslint-plugin-react-a11y`		React accessibility / WCAG.
`eslint-plugin-react-features`		React best practices and optimization.
`eslint-plugin-reliability`		Runtime stability and error safety.

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

View README.md on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarks Star on GitHub