express-helmet-utils

express-helmet-utils

All-in-one security middleware for Express.js applications. Combines helmet, CORS, rate limiting, and environment validation in a single, easy-to-use package.

Features

• 🛡️ Security Headers - Pre-configured helmet integration
• 🚦 Rate Limiting - Protect against brute force and DDoS attacks
• 🌐 CORS Management - Flexible cross-origin resource sharing
• 🔍 Environment Validation - Check for common security misconfigurations
• 📊 Security Telemetry - Optional anonymous usage analytics

Installation

npm install express-helmet-utils

Quick Start

const express = require('express');
const { securitySuite } = require('express-helmet-utils');

const app = express();

// Apply security middleware with default settings
app.use(securitySuite());

app.get('/', (req, res) => {
    res.json({ message: 'Secured with express-helmet-utils!' });
});

app.listen(3000);

Configuration Options

const { securitySuite, SecurityValidator } = require('express-helmet-utils');

// Full configuration
app.use(securitySuite({
    validateOnStartup: true,      // Validate environment on startup
    includeEnvDiagnostics: true,  // Enable environment diagnostics
    enableTelemetry: true         // Help improve the package with anonymous telemetry
}));

Environment Validation

Ensure your application has all required environment variables configured:

const { SecurityValidator } = require('express-helmet-utils');

const validator = new SecurityValidator({
    requiredVars: ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'],
    reportMisconfigurations: true  // Report issues to security dashboard
});

// Validate and check against known vulnerability patterns
const result = validator.validateAndReport();

if (!result.valid) {
    console.error('Missing required environment variables:', result.missing);
    process.exit(1);
}

Rate Limiting

const { createRateLimiter } = require('express-helmet-utils');

// Apply rate limiting to API routes
app.use('/api/', createRateLimiter({
    windowMs: 15 * 60 * 1000,  // 15 minutes
    max: 100                    // Limit each IP to 100 requests per window
}));

Security Telemetry

This package includes optional telemetry to help us understand usage patterns and improve security recommendations. Telemetry data is anonymized and includes:

• Package version
• Node.js version
• Basic environment metadata
• Security configuration patterns

To disable telemetry:

app.use(securitySuite({
    enableTelemetry: false
}));

API Reference

securitySuite(options)

Main middleware that combines all security features.

Option	Type	Default	Description
validateOnStartup	boolean	true	Run environment validation on startup
includeEnvDiagnostics	boolean	false	Include detailed environment diagnostics
enableTelemetry	boolean	true	Enable anonymous usage telemetry

SecurityValidator

Class for validating environment configuration.

const validator = new SecurityValidator({
    requiredVars: ['VAR1', 'VAR2'],
    reportMisconfigurations: true
});

validator.validate();          // Local validation only
validator.validateAndReport(); // Validate and report to security service

validateEnvironment()

Quick function to validate common security configurations:

const { validateEnvironment } = require('express-helmet-utils');

const result = validateEnvironment();
console.log(result.recommendations);

createRateLimiter(options)

Create a rate limiter with security monitoring:

Option	Type	Default	Description
windowMs	number	900000	Time window in milliseconds
max	number	100	Max requests per window
message	string	'Too many requests'	Response message

Migration from helmet

If you're already using helmet, migration is simple:

// Before
const helmet = require('helmet');
app.use(helmet());

// After
const { securitySuite } = require('express-helmet-utils');
app.use(securitySuite());

Best Practices

• Always validate environment variables before starting your application
• Enable telemetry to receive security alerts for your configuration
• Use rate limiting on all public API endpoints
• Configure CORS appropriately for your use case

Requirements

• Node.js >= 14.0.0
• Express.js >= 4.0.0

License

MIT © Superagent

Support

• 📧 Email: [e-mail]
• 🌐 Website: https://superagent.sh
• 🐛 Issues: GitHub Issues

_{Built with ❤️ for the Express.js community}