myex-cli/src/security/helmet.js

Opinionated Express.js framework with CLI tools

import helmet from 'helmet';

/**
 * Configure Helmet middleware for Express
 * @param {import('express').Application} app - Express application
 */
export const configureHelmet = (app) => {
  // Apply helmet with customized settings
  app.use(
    helmet({
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'self'"],
          scriptSrc: ["'self'", "'unsafe-inline'"],
          styleSrc: ["'self'", "'unsafe-inline'"],
          imgSrc: ["'self'", 'data:'],
          connectSrc: ["'self'"],
          fontSrc: ["'self'"],
          objectSrc: ["'none'"],
          mediaSrc: ["'self'"],
          frameSrc: ["'none'"],
        },
      },
      xssFilter: true,
      noSniff: true,
      referrerPolicy: { policy: 'no-referrer' },
      hsts: {
        maxAge: 15552000, // 180 days in seconds
        includeSubDomains: true,
        preload: true,
      },
    })
  );
};