require-helmet

Require helmet middleware for security headers in Express.js applications

Severity: 🔴 High
CWE: CWE-693

Value & investment case

Why this rule pays for itself. Framework: cicd-impact/philosophy.md.

Read also: philosophy.md §investor-frame · niche-presets.json · analyzer-evaluation-framework.md

Rule Details

This rule detects an Express application that renders documents to a browser without mounting helmet.

Missing security headers can expose a rendered page to:

• Clickjacking attacks (X-Frame-Options)
• XSS attacks (X-XSS-Protection, Content-Security-Policy)

The document precondition

Helmet's distinctive headers are instructions to a renderer — they are inert on a response nothing renders. The rule therefore requires evidence that this app returns documents: res.render(…), res.sendFile(…), or a configured view engine (app.set('view engine', …) / app.engine(…)).

res.send(…) is deliberately not evidence: it is the generic responder for JSON, text and buffers, and a linter cannot tell a document from a payload without reading it.

The two headers that do apply to a machine client are owned elsewhere in this plugin — require-strict-transport-security (HSTS) and no-disabled-helmet-protections (X-Content-Type-Options) — so the precondition removes a duplicate finding rather than a unique one.

The escape hatch

If the app binding leaves the file — module.exports = app, export default app, return app, or setAppConfigurations(app) — the middleware stack is assembled somewhere this rule cannot see, and it abstains. Absence of evidence is not evidence of absence.

Partition with require-rate-limiting

Both rules used to report the identical express() node. require-rate-limiting now reports the specific unthrottled credential endpoint instead, so the two are disjoint by construction.

Examples

❌ Incorrect

import express from 'express';
const app = express();

// Renders documents, no helmet - VULNERABLE
app.set('view engine', 'pug');
app.get('/', (req, res) => res.render('home'));

app.listen(3000);

✅ Correct

import express from 'express';
import helmet from 'helmet';

const app = express();

// Helmet adds security headers
app.use(helmet());

app.set('view engine', 'pug');
app.get('/', (req, res) => res.render('home'));

app.listen(3000);

// A static asset server renders nothing itself. Not reported.
const app = express();
app.use(express.static('./public'));
app.listen(8080);

// The app is configured by its importer. Not reported.
const app2 = express();
module.exports = app2;

Options

{
  "rules": {
    "express-security/require-helmet": [
      "error",
      {
        "allowInTests": true,
        "alternativeMiddleware": ["securityHeaders"]
      }
    ]
  }
}

When Not To Use It

Never disable this rule in production. Security headers are a fundamental protection layer.

Known False Negatives

The following patterns are not detected due to static analysis limitations:

App Instance from Variable

Why: Express app stored in variable may not be recognized.

// ❌ NOT DETECTED - App from factory function
const app = createExpressApp();
// Helmet might be applied in createExpressApp, or not

Mitigation: Apply rule to factory modules. Document helmet usage centrally.

Conditional Middleware

Why: Middleware applied inside conditions is not tracked.

// ❌ NOT DETECTED - Conditional helmet
if (process.env.NODE_ENV === 'production') {
  app.use(helmet());
}
// Development may run without headers

Mitigation: Always apply helmet unconditionally. Use environment-specific configuration inside helmet options.

Framework Wrappers

Why: Higher-level frameworks may include helmet internally.

// ❌ FALSE POSITIVE RISK - Framework includes helmet
import { createServer } from '@my-company/express-framework';
const app = createServer(); // May include helmet

Mitigation: Configure alternativeMiddleware option. Add framework-specific patterns.

Late Middleware Application

Why: Helmet applied after route definitions is less effective.

// ❌ NOT DETECTED - Helmet AFTER routes
app.get('/api', handler);
app.use(helmet()); // Security headers won't apply to /api

Mitigation: Ensure helmet is among the first middleware. Review middleware order in code review.

Custom Security Headers

Why: Manual header setting without helmet is not recognized.

// ❌ NOT DETECTED - Manual headers instead of helmet
app.use((req, res, next) => {
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  next();
});

Mitigation: Use helmet for comprehensive coverage. Configure alternativeMiddleware for known patterns.

Further Reading

• Helmet.js Documentation
• OWASP Secure Headers Project
• MDN: HTTP Headers