Helmet.js

https://helmet.js.org/
Admin
Helmet helps secure Node/Express apps by setting HTTP response headers such as...
Tokens:10,085
Snippets:90
Trust Score:8.1
Update:1 week ago
Show doc for...
Tokens:
Raw
### Quick start: apply Helmet middleware

Source: https://helmet.js.org/

Sets 13 HTTP response headers by default. Requires an Express app instance.

```javascript
import helmet from "helmet";

const app = express();

app.use(helmet());

```

--------------------------------

### Configure Strict-Transport-Security header options

Source: https://helmet.js.org/

Configure the Strict-Transport-Security header with maxAge, includeSubDomains, and preload options. The first example uses default includeSubDomains (true), the second disables it, and the third enables preload with a maxAge of 63072000 seconds.

```javascript
// Sets "Strict-Transport-Security: max-age=123456; includeSubDomains"
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 123456,
    },
  }),
);

// Sets "Strict-Transport-Security: max-age=123456"
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 123456,
      includeSubDomains: false,
    },
  }),
);

// Sets "Strict-Transport-Security: max-age=123456; includeSubDomains; preload"
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 63072000,
      preload: true,
    },
  }),
);
```

--------------------------------

### Configure X-DNS-Prefetch-Control allow option

Source: https://helmet.js.org/

Configure the X-DNS-Prefetch-Control header with the allow option. Setting allow to false produces 'off', and true produces 'on'.

```javascript
// Sets "X-DNS-Prefetch-Control: off"
app.use(
  helmet({
    xDnsPrefetchControl: { allow: false },
  }),
);

// Sets "X-DNS-Prefetch-Control: on"
app.use(
  helmet({
    xDnsPrefetchControl: { allow: true },
  }),
);
```

--------------------------------

### Configure X-Frame-Options action option

Source: https://helmet.js.org/

Configure the X-Frame-Options header with the action option. Use 'deny' for DENY and 'sameorigin' for SAMEORIGIN. The legacy ALLOW-FROM directive is not supported.

```javascript
// Sets "X-Frame-Options: DENY"
app.use(
  helmet({
    xFrameOptions: { action: "deny" },
  }),
);

// Sets "X-Frame-Options: SAMEORIGIN"
app.use(
  helmet({
    xFrameOptions: { action: "sameorigin" },
  }),
);
```

--------------------------------

### helmet.xDownloadOptions()

Source: https://helmet.js.org/

Sets the X-Download-Options header to noopen for Internet Explorer 8. Takes no options.

```APIDOC
## helmet.xDownloadOptions()

### Description
Sets the `X-Download-Options` header to `noopen` for Internet Explorer 8. Takes no options.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
None

### Request Example
```js
app.use(helmet());
```

### Response
#### Success Response
Sets the `X-Download-Options: noopen` header.

#### Response Example
```
X-Download-Options: noopen
```

### Usage Notes
- To disable the header, set `xDownloadOptions: false`.
- Can be used as standalone middleware: `app.use(helmet.xDownloadOptions())`.
```

--------------------------------

### Set X-Download-Options header by default

Source: https://helmet.js.org/

Set the X-Download-Options header to noopen by default when using helmet() with no options.

```javascript
// Sets "X-Download-Options: noopen"
app.use(helmet());
```

--------------------------------

### helmet.xDnsPrefetchControl()

Source: https://helmet.js.org/

Sets the X-DNS-Prefetch-Control header to control DNS prefetching. Configure with the allow option.

```APIDOC
## helmet.xDnsPrefetchControl()

### Description
Sets the `X-DNS-Prefetch-Control` header to control DNS prefetching. Configure with the `allow` option.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
#### Options
- **allow** (boolean) - Optional - Whether to enable DNS prefetching. Defaults to `false`.

### Request Example
```js
app.use(
  helmet({
    xDnsPrefetchControl: { allow: true },
  }),
);
```

### Response
#### Success Response
Sets the `X-DNS-Prefetch-Control` header to `on` or `off` based on the `allow` option.

#### Response Example
```
X-DNS-Prefetch-Control: on
```

### Usage Notes
- To disable the header and use the browser's default, set `xDnsPrefetchControl: false`.
- Can be used as standalone middleware: `app.use(helmet.xDnsPrefetchControl())`.
```

--------------------------------

### helmet.xFrameOptions()

Source: https://helmet.js.org/

Sets the X-Frame-Options header to mitigate clickjacking. Configure with the action option.

```APIDOC
## helmet.xFrameOptions()

### Description
Sets the `X-Frame-Options` header to mitigate clickjacking. Configure with the `action` option.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
#### Options
- **action** (string) - Optional - Specifies the directive: `DENY` or `SAMEORIGIN`. Defaults to `SAMEORIGIN`.

### Request Example
```js
app.use(
  helmet({
    xFrameOptions: { action: "deny" },
  }),
);
```

### Response
#### Success Response
Sets the `X-Frame-Options` header with the specified directive.

#### Response Example
```
X-Frame-Options: DENY
```

### Usage Notes
- To disable the header, set `xFrameOptions: false`.
- Can be used as standalone middleware: `app.use(helmet.xFrameOptions())`.
```

--------------------------------

### Configure Referrer-Policy with policy string or array

Source: https://helmet.js.org/

Shows how to set the Referrer-Policy header with a single policy string or an array of strings. When an array is used, the policies are joined with commas, useful for fallback policies. Defaults to 'no-referrer'.

```javascript
// Sets "Referrer-Policy: no-referrer"
app.use(
  helmet({
    referrerPolicy: {
      policy: "no-referrer",
    },
  }),
);

// Sets "Referrer-Policy: origin,unsafe-url"
app.use(
  helmet({
    referrerPolicy: {
      policy: ["origin", "unsafe-url"],
    },
  }),
);
```

--------------------------------

### Configure Cross-Origin-Opener-Policy with Helmet

Source: https://helmet.js.org/

Shows how to set the Cross-Origin-Opener-Policy header to 'same-origin' (default) or 'same-origin-allow-popups' using Helmet options. Can also be used as standalone middleware with helmet.crossOriginOpenerPolicy().

```javascript
// Sets "Cross-Origin-Opener-Policy: same-origin"
app.use(helmet());

// Sets "Cross-Origin-Opener-Policy: same-origin-allow-popups"
app.use(
  helmet({
    crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
  }),
);
```

--------------------------------

### Disable X-Download-Options header

Source: https://helmet.js.org/

Disable the X-Download-Options header.

```javascript
app.use(
  helmet({
    xDownloadOptions: false,
  }),
);
```

--------------------------------

### Set X-Permitted-Cross-Domain-Policies with permittedPolicies

Source: https://helmet.js.org/

Configure the X-Permitted-Cross-Domain-Policies header with permittedPolicies set to "none" or "by-content-type". The permittedPolicies option accepts "none", "master-only", "by-content-type", or "all" and defaults to "none".

```javascript
// Sets "X-Permitted-Cross-Domain-Policies: none"
app.use(
  helmet({
    xPermittedCrossDomainPolicies: {
      permittedPolicies: "none",
    },
  }),
);

// Sets "X-Permitted-Cross-Domain-Policies: by-content-type"
app.use(
  helmet({
    xPermittedCrossDomainPolicies: {
      permittedPolicies: "by-content-type",
    },
  }),
);
```

--------------------------------

### Set X-DNS-Prefetch-Control header by default

Source: https://helmet.js.org/

Set the X-DNS-Prefetch-Control header to off by default when using helmet() with no options.

```javascript
// Sets "X-DNS-Prefetch-Control: off"
app.use(helmet());
```

--------------------------------

### helmet.xContentTypeOptions()

Source: https://helmet.js.org/

Sets the X-Content-Type-Options header to nosniff to mitigate MIME type sniffing. Takes no options.

```APIDOC
## helmet.xContentTypeOptions()

### Description
Sets the `X-Content-Type-Options` header to `nosniff` to mitigate MIME type sniffing. Takes no options.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
None

### Request Example
```js
app.use(helmet());
```

### Response
#### Success Response
Sets the `X-Content-Type-Options: nosniff` header.

#### Response Example
```
X-Content-Type-Options: nosniff
```

### Usage Notes
- To disable the header, set `xContentTypeOptions: false`.
- Can be used as standalone middleware: `app.use(helmet.xContentTypeOptions())`.
```

--------------------------------

### Configure Cross-Origin-Resource-Policy with Helmet

Source: https://helmet.js.org/

Shows how to set the Cross-Origin-Resource-Policy header to 'same-origin' (default) or 'same-site' using Helmet options. Can also be used as standalone middleware with helmet.crossOriginResourcePolicy().

```javascript
// Sets "Cross-Origin-Resource-Policy: same-origin"
app.use(helmet());

// Sets "Cross-Origin-Resource-Policy: same-site"
app.use(helmet({ crossOriginResourcePolicy: { policy: "same-site" } }));
```

--------------------------------

### Use Content-Security-Policy-Report-Only

Source: https://helmet.js.org/

Sets the Content-Security-Policy-Report-Only header instead of the normal one by setting reportOnly: true.

```javascript
// Sets the Content-Security-Policy-Report-Only header
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        /* ... */
      },
      reportOnly: true,
    },
  }),
);

```

--------------------------------

### Set X-Frame-Options header by default

Source: https://helmet.js.org/

Set the X-Frame-Options header to SAMEORIGIN by default when using helmet() with no options.

```javascript
// Sets "X-Frame-Options: SAMEORIGIN"
app.use(helmet());
```

--------------------------------

### helmet.xPermittedCrossDomainPolicies()

Source: https://helmet.js.org/

Sets the X-Permitted-Cross-Domain-Policies header to none. Takes no options.

```APIDOC
## helmet.xPermittedCrossDomainPolicies()

### Description
Sets the `X-Permitted-Cross-Domain-Policies` header to `none`. Takes no options.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
None

### Request Example
```js
app.use(helmet());
```

### Response
#### Success Response
Sets the `X-Permitted-Cross-Domain-Policies: none` header.

#### Response Example
```
X-Permitted-Cross-Domain-Policies: none
```

### Usage Notes
- This header is set by default and takes no options.
```

--------------------------------

### X-Download-Options default header

Source: https://helmet.js.org/

Default value of the X-Download-Options header, specific to Internet Explorer 8.

```http
X-Download-Options: noopen
```

--------------------------------

### Set X-Permitted-Cross-Domain-Policies header by default

Source: https://helmet.js.org/

Set the X-Permitted-Cross-Domain-Policies header to none by default when using helmet() with no options.

```javascript
// Sets "X-Permitted-Cross-Domain-Policies: none"
app.use(helmet());
```

--------------------------------

### Set Origin-Agent-Cluster header with Helmet

Source: https://helmet.js.org/

Sets the Origin-Agent-Cluster header to '?1' (default). This header takes no options and is set by default. Can also be used as standalone middleware with helmet.originAgentCluster().

```javascript
// Sets "Origin-Agent-Cluster: ?1"
app.use(helmet());
```

--------------------------------

### Set X-Content-Type-Options header by default

Source: https://helmet.js.org/

Set the X-Content-Type-Options header to nosniff by default when using helmet() with no options.

```javascript
// Sets "X-Content-Type-Options: nosniff"
app.use(helmet());
```

--------------------------------

### helmet.xPoweredBy

Source: https://helmet.js.org/

Removes the X-Powered-By header. This behavior is enabled by default and takes no options.

```APIDOC
## helmet.xPoweredBy

### Description
Removes the `X-Powered-By` header, which is set by default in Express and some other frameworks. This behavior is enabled by default and takes no options.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
None

### Request Example
```js
app.use(
  helmet({
    xPoweredBy: false,
  }),
);
```

### Response
#### Success Response
Removes the `X-Powered-By` header from the response.

### Disabling
To disable this behavior, set `xPoweredBy` to `false`.

```js
app.use(
  helmet({
    xPoweredBy: false,
  }),
);
```

### Standalone Usage
```js
app.use(helmet.xPoweredBy());
```
```

--------------------------------

### CSP with useDefaults: false

Source: https://helmet.js.org/

Disables default directives with useDefaults: false and sets a custom policy. The comment shows the resulting header.

```javascript
// Sets "Content-Security-Policy: default-src 'self';
// script-src 'self' example.com;object-src 'none';
// upgrade-insecure-requests"
app.use(
  helmet({
    contentSecurityPolicy: {
      useDefaults: false,
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "example.com"],
        objectSrc: ["'none'"],
        upgradeInsecureRequests: [],
      },
    },
  }),
);

```

--------------------------------

### Set Referrer-Policy header with Helmet

Source: https://helmet.js.org/

Sets the Referrer-Policy header to 'no-referrer' (default) using Helmet options.

```javascript
// Sets "Referrer-Policy: no-referrer"
app.use(helmet());
```

--------------------------------

### helmet.xXssProtection

Source: https://helmet.js.org/

Sets the X-XSS-Protection header to 0 to disable browsers' buggy cross-site scripting filter. This header takes no options and is set by default.

```APIDOC
## helmet.xXssProtection

### Description
Sets the `X-XSS-Protection` header to `0` to disable browsers' buggy cross-site scripting filter. This header takes no options and is set by default.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
None

### Request Example
```js
app.use(
  helmet({
    xXssProtection: false,
  }),
);
```

### Response
#### Success Response
Sets the `X-XSS-Protection` header to `0`.

#### Response Example
```
X-XSS-Protection: 0
```

### Disabling
To disable the header, set `xXssProtection` to `false`.

```js
app.use(
  helmet({
    xXssProtection: false,
  }),
);
```

### Standalone Usage
```js
app.use(helmet.xXssProtection());
```
```

--------------------------------

### Disable headers: contentSecurityPolicy and xDownloadOptions

Source: https://helmet.js.org/

Disables specific headers by setting their option to false. Here, both Content-Security-Policy and X-Download-Options are disabled.

```javascript
// Disable the Content-Security-Policy and X-Download-Options headers
app.use(
  helmet({
    contentSecurityPolicy: false,
    xDownloadOptions: false,
  }),
);

```

--------------------------------

### X-DNS-Prefetch-Control default header

Source: https://helmet.js.org/

Default value of the X-DNS-Prefetch-Control header, which controls DNS prefetching.

```http
X-DNS-Prefetch-Control: off
```

--------------------------------

### Configure CSP: script-src directive

Source: https://helmet.js.org/

Configures the Content-Security-Policy header by passing header-specific options. The directives object uses camelCase or kebab-case directive names.

```javascript
// Configure the Content-Security-Policy header.
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "script-src": ["'self'", "example.com"],
      },
    },
  }),
);

```

--------------------------------

### Default CSP directives list

Source: https://helmet.js.org/

Default directives object returned by helmet.contentSecurityPolicy.getDefaultDirectives(), formatted for readability.

```http
default-src 'self';
base-uri 'self';
font-src 'self' https: data:;
form-action 'self';
frame-ancestors 'self';
img-src 'self' data:;
object-src 'none';
script-src 'self';
script-src-attr 'none';
style-src 'self' https: 'unsafe-inline';
upgrade-insecure-requests

```

--------------------------------

### Disable X-Content-Type-Options header

Source: https://helmet.js.org/

Disable the X-Content-Type-Options header.

```javascript
app.use(
  helmet({
    xContentTypeOptions: false,
  }),
);
```

--------------------------------

### Disable upgrade-insecure-requests in development

Source: https://helmet.js.org/

Disables upgrade-insecure-requests in development to avoid Safari upgrading localhost to HTTPS. Uses environment check.

```javascript
const isDevelopment = app.get("env") === "development";

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        // Disable upgrade-insecure-requests in development.
        "upgrade-insecure-requests": isDevelopment ? null : [],
      },
    },
  }),
);

```

--------------------------------

### CSP nonce with dynamic directive function

Source: https://helmet.js.org/

Uses a function in the directives array to generate a nonce per request. The function receives request and response objects.

```javascript
// Sets the `script-src` directive to
// "'self' 'nonce-e33cc...'"
// (or similar)
app.use((req, res, next) => {
  res.locals.cspNonce = crypto.randomBytes(32).toString("hex");
  next();
});
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
      },
    },
  }),
);

```

--------------------------------

### X-Frame-Options default header

Source: https://helmet.js.org/

Default value of the X-Frame-Options header, which mitigates clickjacking attacks.

```http
X-Frame-Options: SAMEORIGIN
```

--------------------------------

### helmet.strictTransportSecurity()

Source: https://helmet.js.org/

Sets the Strict-Transport-Security header to enforce HTTPS. Configure with maxAge, includeSubDomains, and preload options.

```APIDOC
## helmet.strictTransportSecurity()

### Description
Sets the `Strict-Transport-Security` header to enforce HTTPS. Configure with `maxAge`, `includeSubDomains`, and `preload` options.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
#### Options
- **maxAge** (number) - Optional - Number of seconds browsers should remember to prefer HTTPS. Non-integer values are rounded down. Defaults to 365 days.
- **includeSubDomains** (boolean) - Optional - Whether to include the `includeSubDomains` directive. Defaults to `true`.
- **preload** (boolean) - Optional - If true, adds the `preload` directive. Defaults to `false`.

### Request Example
```js
app.use(
  helmet({
    strictTransportSecurity: {
      maxAge: 123456,
    },
  }),
);
```

### Response
#### Success Response
Sets the `Strict-Transport-Security` header with the configured directives.

#### Response Example
```
Strict-Transport-Security: max-age=123456; includeSubDomains
```

### Usage Notes
- To disable the header, set `strictTransportSecurity: false`.
- Can be used as standalone middleware: `app.use(helmet.strictTransportSecurity())`.
```

--------------------------------

### Disable X-Frame-Options header

Source: https://helmet.js.org/

Disable the X-Frame-Options header.

```javascript
app.use(
  helmet({
    xFrameOptions: false,
  }),
);
```

--------------------------------

### Disable X-DNS-Prefetch-Control header

Source: https://helmet.js.org/

Disable the X-DNS-Prefetch-Control header, using the browser's default value.

```javascript
app.use(
  helmet({
    xDnsPrefetchControl: false,
  }),
);
```

--------------------------------

### Disable X-XSS-Protection header

Source: https://helmet.js.org/

Disable the X-XSS-Protection header by setting xXssProtection to false. This is not recommended. Can also be used as standalone middleware with app.use(helmet.xXssProtection()).

```javascript
// This is not recommended.
app.use(
  helmet({
    xXssProtection: false,
  }),
);
```

--------------------------------

### helmet.xPermittedCrossDomainPolicies

Source: https://helmet.js.org/

Sets the X-Permitted-Cross-Domain-Policies header. The permittedPolicies option accepts 'none', 'master-only', 'by-content-type', or 'all' and defaults to 'none'.

```APIDOC
## helmet.xPermittedCrossDomainPolicies

### Description
Sets the `X-Permitted-Cross-Domain-Policies` header. The `permittedPolicies` option accepts `"none"`, `"master-only"`, `"by-content-type"`, or `"all"` and defaults to `"none"`.

### Method
Middleware

### Endpoint
N/A (Express middleware)

### Parameters
#### Options
- **permittedPolicies** (string) - Optional - Must be `"none"`, `"master-only"`, `"by-content-type"`, or `"all"`. Defaults to `"none"`.

### Request Example
```js
app.use(
  helmet({
    xPermittedCrossDomainPolicies: {
      permittedPolicies: "none",
    },
  }),
);
```

### Response
#### Success Response
Sets the `X-Permitted-Cross-Domain-Policies` header to the specified value.

#### Response Example
```
X-Permitted-Cross-Domain-Policies: none
```

### Disabling
To disable the header, set `xPermittedCrossDomainPolicies` to `false`.

```js
app.use(
  helmet({
    xPermittedCrossDomainPolicies: false,
  }),
);
```

### Standalone Usage
```js
app.use(helmet.xPermittedCrossDomainPolicies());
```
```

--------------------------------

### Set Strict-Transport-Security header with Helmet

Source: https://helmet.js.org/

Sets the Strict-Transport-Security header to 'max-age=31536000; includeSubDomains' (default) using Helmet.

```javascript
// Sets "Strict-Transport-Security: max-age=31536000; includeSubDomains"
app.use(helmet());
```

--------------------------------

### Default Content-Security-Policy header

Source: https://helmet.js.org/

Default Content-Security-Policy header value. Mitigates attacks like cross-site scripting but likely requires configuration for your app.

```http
Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests

```

--------------------------------

### Default Cross-Origin-Opener-Policy header value

Source: https://helmet.js.org/

The default value of the Cross-Origin-Opener-Policy header is 'same-origin'.

```http
Cross-Origin-Opener-Policy: same-origin
```

--------------------------------

### Cross-Origin-Embedder-Policy

Source: https://helmet.js.org/

Sets the Cross-Origin-Embedder-Policy header to control cross-origin resource loading. Not set by default.

```APIDOC
## [MIDDLEWARE] helmet.crossOriginEmbedderPolicy

### Description
Sets the Cross-Origin-Embedder-Policy header to control what resources can be loaded cross-origin. Not set by default.

### Usage
Can be used as standalone middleware with `app.use(helmet.crossOriginEmbedderPolicy())` or configured via the `crossOriginEmbedderPolicy` option in `helmet()`.

### Options
- **policy** (string) - Optional - The policy value. Can be `"require-corp"` or `"credentialless"`. Defaults to `"require-corp"` when enabled.

### Examples
```js
// Sets 
```

--------------------------------

### Override and disable CSP directives

Source: https://helmet.js.org/

Overrides script-src and disables style-src while keeping other defaults. Setting a directive to null disables it.

```javascript
// Sets all of the defaults, but overrides `script-src`
// and disables the default `style-src`.
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "script-src": ["'self'", "example.com"],
        "style-src": null,
      },
    },
  }),
);

```

--------------------------------

### Configure Cross-Origin-Embedder-Policy with Helmet

Source: https://helmet.js.org/

Shows how to set the Cross-Origin-Embedder-Policy header to 'require-corp' or 'credentialless' using Helmet options. By default, Helmet does not set this header. Can also be used as standalone middleware with helmet.crossOriginEmbedderPolicy().

```javascript
// Helmet does not set Cross-Origin-Embedder-Policy
// by default.
app.use(helmet());

// Sets "Cross-Origin-Embedder-Policy: require-corp"
app.use(helmet({ crossOriginEmbedderPolicy: true }));

// Sets "Cross-Origin-Embedder-Policy: credentialless"
app.use(helmet({ crossOriginEmbedderPolicy: { policy: "credentialless" } }));
```

--------------------------------

### Default Origin-Agent-Cluster header value

Source: https://helmet.js.org/

The default value of the Origin-Agent-Cluster header is '?1'.

```http
Origin-Agent-Cluster: ?1
```

--------------------------------

### X-Content-Type-Options default header

Source: https://helmet.js.org/

Default value of the X-Content-Type-Options header, which mitigates MIME type sniffing.

```http
X-Content-Type-Options: nosniff
```

--------------------------------

### Disable X-Powered-By header removal

Source: https://helmet.js.org/

Disable the X-Powered-By header removal. The first line uses Express's built-in method, and the second tells Helmet to ignore the header. The header is removed by default and takes no options.

```javascript
// Not required, but recommended for Express users:
app.disable("x-powered-by");

// Ask Helmet to ignore the X-Powered-By header.
app.use(
  helmet({
    xPoweredBy: false,
  }),
);
```

--------------------------------

### X-Permitted-Cross-Domain-Policies default header

Source: https://helmet.js.org/

Default value of the X-Permitted-Cross-Domain-Policies header, which tells some clients (mostly Adobe products) the domain's policy for loading cross-domain content.

```http
X-Permitted-Cross-Domain-Policies: none
```

--------------------------------

### Disable X-Permitted-Cross-Domain-Policies header

Source: https://helmet.js.org/

Disable the X-Permitted-Cross-Domain-Policies header by setting xPermittedCrossDomainPolicies to false. This can also be used as standalone middleware with app.use(helmet.xPermittedCrossDomainPolicies()).

```javascript
app.use(
  helmet({
    xPermittedCrossDomainPolicies: false,
  }),
);
```

--------------------------------

### Default X-XSS-Protection header value

Source: https://helmet.js.org/

Default header value set by Helmet to disable browsers' buggy cross-site scripting filter. This header takes no options and is set by default.

```http
X-XSS-Protection: 0
```

--------------------------------

### Disable Content-Security-Policy header

Source: https://helmet.js.org/

Disables the Content-Security-Policy header entirely by setting contentSecurityPolicy to false.

```javascript
app.use(
  helmet({
    contentSecurityPolicy: false,
  }),
);

```

--------------------------------

### Default Cross-Origin-Resource-Policy header value

Source: https://helmet.js.org/

The default value of the Cross-Origin-Resource-Policy header is 'same-origin'.

```http
Cross-Origin-Resource-Policy: same-origin
```

--------------------------------

### Disable Cross-Origin-Opener-Policy header

Source: https://helmet.js.org/

Disables the Cross-Origin-Opener-Policy header by setting crossOriginOpenerPolicy to false.

```javascript
app.use(
  helmet({
    crossOriginOpenerPolicy: false,
  }),
);
```

--------------------------------

### Disable Referrer-Policy header

Source: https://helmet.js.org/

Disables the Referrer-Policy header by setting referrerPolicy to false.

```javascript
app.use(
  helmet({
    referrerPolicy: false,
  }),
);
```

--------------------------------

### Default Referrer-Policy header value

Source: https://helmet.js.org/

The default value of the Referrer-Policy header is 'no-referrer'.

```http
Referrer-Policy: no-referrer
```

--------------------------------

### Disable Origin-Agent-Cluster header

Source: https://helmet.js.org/

Disables the Origin-Agent-Cluster header by setting originAgentCluster to false.

```javascript
app.use(
  helmet({
    originAgentCluster: false,
  }),
);
```

--------------------------------

### Disable Strict-Transport-Security header

Source: https://helmet.js.org/

Disable the Strict-Transport-Security header. Useful for local development to avoid forced redirects from http://localhost to https://localhost.

```javascript
app.use(
  helmet({
    strictTransportSecurity: false,
  }),
);
```

--------------------------------

### Disable Cross-Origin-Resource-Policy header

Source: https://helmet.js.org/

Disables the Cross-Origin-Resource-Policy header by setting crossOriginResourcePolicy to false.

```javascript
app.use(
  helmet({
    crossOriginResourcePolicy: false,
  }),
);
```

--------------------------------

### Default Strict-Transport-Security header value

Source: https://helmet.js.org/

The default value of the Strict-Transport-Security header is 'max-age=31536000; includeSubDomains'.

```http
Strict-Transport-Security: max-age=31536000; includeSubDomains
```
Tokens:
Raw