helmet

import crypto from 'crypto';
import helmet from 'helmet';
import type { Express, Request, Response, NextFunction } from 'express';

function cspNonce(req: Request, res: Response, next: NextFunction): void {
  res.locals.cspNonce = crypto.randomBytes(16).toString('base64');

Security headers with helmet (baseline hardening)

security express helmet

by codesnips 3 tabs

typescript

import { randomBytes } from 'crypto';
import { Request, Response, NextFunction } from 'express';

interface CspOptions {
  reportOnly?: boolean;
  reportUri?: string;

Content Security Policy headers (defense-in-depth)

security express csp

by codesnips 3 tabs