koa-helmet is a wrapper for helmet to work with koa.
npm install koa-helmet --save
Usage is the same as helmet
Helmet offers 10 security middleware functions:
- contentSecurityPolicy for setting Content Security Policy
- dnsPrefetchControl controls browser DNS prefetching
- frameguard to prevent clickjacking
- hidePoweredBy to remove the X-Powered-By header
- hpkp for HTTP Public Key Pinning
- hsts for HTTP Strict Transport Security
- ieNoOpen sets X-Download-Options for IE8+
- noCache to disable client-side caching
- noSniff to keep clients from sniffing the MIME type
- xssFilter adds some small XSS protections
Running app.use(helmet()) will include 7 of the 10, leaving out contentSecurityPolicy, hpkp, and noCache. You can also use each module individually, as documented below.
var Koa = require('koa');
var helmet = require('koa-helmet');
var app = new Koa();
app.use(helmet());
app.use((ctx) => {
ctx.body = 'Hello World';
});
app.listen(4000);- koa-helmet 2.x (master branch) supports koa 2.x
- koa-helmet 1.x (koa-1 branch) supports koa 0.x and koa 1.x