Ccodemod

codemod/express-helmet-middleware-integration

Transform Express applications to automatically include Helmet middleware for security headers like CSP, HSTS, and XSS protection

securityexpresshelmetheaderscsphstsxsstransformation
Public
0 executions
Apply to Repository

Run locally

npx codemod @codemod/express-helmet-middleware-integration

Express Helmet Middleware Integration

This codemod automatically adds Helmet security middleware to Express.js applications to protect against common web vulnerabilities including XSS, clickjacking, MIME sniffing, and man-in-the-middle attacks.

Security Issues Addressed

This codemod helps protect your Express applications against several critical security vulnerabilities:

  • CWE-79: Cross-site Scripting (XSS)
  • CWE-1021: Improper Restriction of Rendered UI Layers or Frames (Clickjacking)
  • CWE-693: Protection Mechanism Failure (Missing Security Headers)

See the security references below for more details.

What It Does

  • Adds Helmet import: Automatically imports the helmet package using the appropriate syntax (CommonJS or ES6)
  • Adds comprehensive security configuration: Includes Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, and X-Content-Type-Options
  • Smart middleware placement: Inserts helmet middleware early in the middleware stack for maximum protection
  • Preserves existing code: Only adds helmet if not already present

Installation

bash

Before & After Examples

CommonJS (before)

javascript

CommonJS (after)

javascript

ES6 Modules (before)

javascript

ES6 Modules (after)

javascript

Configuration Details

The codemod adds helmet with a comprehensive but functional security configuration:

Content Security Policy (CSP)

  • defaultSrc: ["'self'"] - Only allow resources from the same origin
  • styleSrc: ["'self'", "'unsafe-inline'"] - Allow inline styles (common requirement)
  • scriptSrc: ["'self'"] - Only allow scripts from the same origin
  • imgSrc: ["'self'", "data:", "https:"] - Allow images from same origin, data URLs, and HTTPS

HTTP Strict Transport Security (HSTS)

  • maxAge: 31536000 - 1 year duration
  • includeSubDomains: true - Apply to all subdomains
  • preload: true - Enable HSTS preloading

What Gets Transformed

✅ Will Transform

  • Files with Express app initialization (app = express())
  • Files importing the express module
  • Files with existing middleware but no helmet
  • Both CommonJS and ES6 module syntax
  • Multiple Express app instances in the same file

❌ Will NOT Transform

  • Test files (*.test.js, *.spec.js, __tests__/)
  • Files already using helmet
  • Express Router instances (they inherit security from the main app)
  • Mock or stub files
  • Files without Express app initialization
  • Files in node_modules

Limitations & Considerations

  1. CSP Configuration: The default CSP policy is restrictive but functional. You may need to adjust it based on your application's specific needs (external APIs, CDNs, etc.)

  2. Inline Styles: The configuration allows 'unsafe-inline' for CSS which reduces security but is often required for UI frameworks. Consider removing this and using nonces or hashes for better security.

  3. Multiple App Instances: If you have multiple Express apps in one file, helmet will be added to each one.

  4. Middleware Order: Helmet is inserted early in the middleware stack, but you should verify the order is appropriate for your use case.

Development

bash

Security References

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community