Helmet is a collection of middleware functions for securing Express apps. It sets various HTTP headers to guard against common web vulnerabilities. This query detects Helmet misconfigurations that can lead to security vulnerabilities, specifically:

Content Security Policy (CSP) helps spot and prevent injection attacks such as Cross-Site Scripting (XSS). Removing frame protections exposes an application to attacks such as clickjacking, where an attacker can trick a user into clicking on a button or link on a targeted page when they intended to click on the page carrying out the attack.

Users of the query can extend the set of required Helmet features by adding additional checks for them, using CodeQL data extensions. 

extensions:
  - addsTo:
      pack: codeql/javascript-all
      extensible: requiredHelmetSecuritySetting
data:
    - ["frameguard"]

Note: frameguard is an example: the query already enforces this setting, so it is not necessary to add it to the data extension.

To help mitigate these vulnerabilities, ensure that the following Helmet functions are not disabled, and are configured appropriately to your application:

The following code snippet demonstrates Helmet configured in an insecure manner:

In this example, the defaults are used, which enables frame protection and a default Content Security Policy.

You can also enable a custom Content Security Policy by passing an object to the contentSecurityPolicy key. For example, taken from the Helmet docs:

  • helmet.js website