@mashroom/mashroom-helmet

Mashroom Helmet

Plugin for Mashroom Server, a Microfrontend Integration Platform.

This plugin adds the Helmet middleware which sets a bunch of protective HTTP headers on each response.

Usage

If node_modules/@mashroom is configured as plugin path just add @mashroom/mashroom-helmet as dependency.

You can override the default config in your Mashroom config file like this:

{
    "plugins": {
        "Mashroom Helmet Middleware": {
            "helmet": {
                "contentSecurityPolicy": false,
                "crossOriginEmbedderPolicy": false,
                "crossOriginOpenerPolicy": {
                    "policy": "same-origin"
                },
                "crossOriginResourcePolicy": {
                    "policy": "same-site"
                },
                "expectCt": false,
                "referrerPolicy": false,
                "hsts": {
                    "maxAge": 31536000
                },
                "noSniff": true,
                "originAgentCluster": false,
                "dnsPrefetchControl": {
                    "allow": false
                },
                "frameguard": {
                    "action": "sameorigin"
                },
                "permittedCrossDomainPolicies": {
                    "permittedPolicies": "none"
                },
                "hidePoweredBy": false,
                "xssFilter": true
            }
        }
    }
}

• helmet: The configuration will directly be passed to Helmet middelware. Checkout the Helmet Documentation for available options.

**NOTE**: You shouldn't enable the _noCache_ module because this would significantly decrease the performance of the _Mashroom Portal_.

Changelog

2.9.2 (August 29, 2025)

• Admin App: Fixed the problem that the old App config was shown after re-opening the App config dialog
• Tabify App: Fixed a timing problem when adding a new App dynamically, which made it invisible until clicking on the tab header