no-missing-security-headers
Detects missing security headers in HTTP responses
Deprecated. Use
require-helmetinstead.
Status: 🚫 Deprecated — replaced by require-helmet
CWE: CWE-693
Why this rule was replaced
Header-by-header detection duplicated what helmet already guarantees as a
bundle. require-helmet checks for the middleware that sets the whole
header suite (CSP, X-Frame-Options, HSTS, X-Content-Type-Options), which is
the fix this rule's own message recommended.
The rule id still resolves so existing configs keep working, but it receives no new detection work. Reports carry the same CWE metadata as before.
Migration
// eslint.config.js
{
rules: {
// before
'express-security/no-missing-security-headers': 'error',
// after
'express-security/require-helmet': 'error',
},
}No source changes are needed — only the rule id in your config.
Options
| Option | Type | Default | Description |
|---|---|---|---|
requiredHeaders | string[] | the built-in header set | Security headers every response must set |
ignoreInTests | boolean | true | Skip the check in test files |
Related Rules
require-helmet— the maintained replacement
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.