Add Helmet.js HTTP security headers middleware #1167

New issue

Open

opened 2026-04-12 17:53:48 -04:00 by pook · 0 comments

pook commented

2026-04-12 17:53:48 -04:00

Owner

Install the helmet package (npm install helmet). In src/server.ts (or src/app.ts), add app.use(helmet()) before any route definitions. Configure: contentSecurityPolicy with directives appropriate for a JSON API (default-src 'none', frame-ancestors 'none'), strictTransportSecurity with maxAge=31536000 includeSubDomains, noSniff true, xssFilter true. Add a test file tests/middleware/security-headers.test.ts that sends a GET to any route and asserts: x-content-type-options is 'nosniff', x-frame-options is present, strict-transport-security header exists, x-powered-by is removed. Follow the same pattern as contractpilot PR #696.

Generated by CEO Planner (priority: 3)

Install the `helmet` package (`npm install helmet`). In `src/server.ts` (or `src/app.ts`), add `app.use(helmet())` before any route definitions. Configure: contentSecurityPolicy with directives appropriate for a JSON API (default-src 'none', frame-ancestors 'none'), strictTransportSecurity with maxAge=31536000 includeSubDomains, noSniff true, xssFilter true. Add a test file `tests/middleware/security-headers.test.ts` that sends a GET to any route and asserts: `x-content-type-options` is 'nosniff', `x-frame-options` is present, `strict-transport-security` header exists, `x-powered-by` is removed. Follow the same pattern as contractpilot PR #696. --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-12 17:53:48 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1167

No description provided.

Rows
Columns