koa-helmet

koa-helmet

koa-helmet is a wrapper for helmet to work with koa (v2 and v3). It provides important security headers to make your app more secure by default.

This package has zero direct dependencies, with peerDependencies of koa and helmet.

Installation

npm i koa-helmet helmet

# or:

bun add koa-helmet helmet

Usage

Usage is the same as helmet

Helmet offers 11 security middleware functions:

// This...
app.use(helmet());

// ...is equivalent to this:
app.use(helmet.contentSecurityPolicy());
app.use(helmet.dnsPrefetchControl());
app.use(helmet.expectCt());
app.use(helmet.frameguard());
app.use(helmet.hidePoweredBy());
app.use(helmet.hsts());
app.use(helmet.ieNoOpen());
app.use(helmet.noSniff());
app.use(helmet.permittedCrossDomainPolicies());
app.use(helmet.referrerPolicy());
app.use(helmet.xssFilter());

You can see more in the documentation.

Example

import Koa from "koa";
import helmet from "koa-helmet";

const app = new Koa();

app.use(helmet());

app.use((ctx) => {
  ctx.body = "Hello World";
});

app.listen(4000);

Testing

To run the test and lint suite, simply run

npm check

Alternatively, you can run:

npm run test
npm run lint
npm run format:check

Contributing

Please see CONTRIBUTING.md for details.

Versioning

• koa-helmet >=2.x (main branch) supports koa 2.x and 3.x
• koa-helmet 1.x (koa-1 branch) supports koa 0.x and koa 1.x

Similar packages

Other packages similar to koa-helmet

helmet

Helmet is a middleware for Express.js that helps secure your Express applications by setting various HTTP headers. It is the original library that koa-helmet wraps around. While koa-helmet is specifically designed for Koa.js, Helmet is designed for Express.js.

lusca

Lusca is another security middleware for Express.js that provides various security features such as CSRF protection, XSS protection, and more. It is similar to Helmet but offers additional features like CSRF protection out of the box.

express-rate-limit

Express-rate-limit is a middleware for Express.js that helps to limit repeated requests to public APIs and/or endpoints. While it does not provide the same HTTP header protections as koa-helmet, it is useful for preventing abuse and brute-force attacks.