expect-ct

library1.0.0jsnpmunverified

The `expect-ct` package provides Express middleware for setting the deprecated Expect-CT HTTP response header. This header was designed to enforce Certificate Transparency (CT) requirements by instructing browsers to expect valid Signed Certificate Timestamps (SCTs) for a website's TLS certificates. However, the Expect-CT header itself has been deprecated by major browsers (e.g., Chrome removed support in version 107 in October 2022) as Certificate Transparency is now a baseline requirement enforced by default across all publicly trusted certificates. As such, this middleware, currently at version 1.0.0 (though `1.0.1` is on npm, published 3 years ago), offers minimal practical security benefit for modern web applications. The Helmet.js project, which originally included this functionality, removed `expect-ct` from its default middlewares in Helmet v5 due to its obsolescence.

auth-security web-framework http-networking

npm install expect-ct

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · EXPECT-CT

expect-ct

auth-securityjavascriptv1.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

expectCt

✓ import expectCt from 'expect-ct';

✗ import { expectCt } from 'expect-ct';

The package exports a default function. Though TypeScript types are shipped, the primary usage is with CommonJS `require`.

expectCt

✓ const expectCt = require('expect-ct');

CommonJS `require` is the most common way to import this middleware, as shown in the package's documentation.

Demonstrates how to integrate `expect-ct` middleware into an Express application to set the Expect-CT header, including options for `maxAge`, `enforce`, and `reportUri`.

import express from 'express'; import expectCt from 'expect-ct'; const app = express(); const port = process.env.PORT ?? 3000; // Sets Expect-CT: max-age=123 app.use(expectCt({ maxAge: 123 })); // Optionally, enforce and report app.use( expectCt({ enforce: true, maxAge: 30, reportUri: 'https://example.com/report' // Replace with your actual reporting endpoint }) ); app.get('/', (req, res) => { res.send('Hello, Expect-CT!'); }); app.listen(port, () => { console.log(`Server listening on port ${port}`); console.warn('The Expect-CT header is largely deprecated and may not provide significant security benefits in modern browsers.'); });

Debug

Known issues

deprecatedThe Expect-CT HTTP header itself is deprecated and largely obsolete. Most major browsers (like Chrome since version 107 in October 2022) have removed support or no longer process this header, as Certificate Transparency is now a default, built-in security measure.

fix

Consider removing the `expect-ct` middleware entirely from new projects. For existing projects, its removal will likely have no adverse security impact on modern browsers.

affects: >=1.0.0

breakingThe `expect-ct` middleware is no longer included by default in Helmet.js version 5 and later. If you upgraded Helmet and rely on Expect-CT, you will need to install and configure this standalone package explicitly, although it is not recommended due to header deprecation.

fix

To achieve similar (though now largely ineffective) functionality with Helmet v5+, explicitly install `expect-ct` (`npm install expect-ct`) and use `app.use(expectCt(options))` alongside Helmet.

affects: >=1.0.0 (when used with Helmet v5+)

gotchaThe Expect-CT header only functions over HTTPS connections. Browsers will ignore the header if sent over plain HTTP.

fix

Ensure your application is served exclusively over HTTPS for any Expect-CT policy to be considered by the browser. However, given the header's deprecation, investing in this is generally not recommended.

affects: >=1.0.0

gotchaOnly Chromium-based browsers (e.g., Google Chrome, Microsoft Edge) ever implemented support for the Expect-CT header. Other browsers like Firefox and Safari never adopted it.

fix

Be aware that any 'protection' offered by this header was limited to a subset of browsers. This further reduces its utility for broad web security.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: expectCt is not a function

Incorrect import: Attempting to destructure a default export, or mixing CommonJS `require` syntax with ESM `import` for a default export.

fix

For CommonJS: `const expectCt = require('expect-ct');`. For ESM: `import expectCt from 'expect-ct';` (without curly braces).

ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

While Expect-CT is deprecated, if it were still enforced by a browser (e.g., an older Chrome version), this error indicates that your site's SSL/TLS certificate is not satisfying Certificate Transparency requirements.

fix

Contact your Certificate Authority (CA) to ensure your certificates include Signed Certificate Timestamps (SCTs) and are properly logged in CT logs. This is a fundamental requirement for modern certificates, irrespective of the Expect-CT header.

Upgrade

Version history

1.0.0latest on npm

Audit

Dependencies

expressrequiredThis is an Express middleware, requiring Express for application integration.

Agent activity

26 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/helmetjs/helmet ↗

packagehttps://www.npmjs.com/package/expect-ct ↗

homepagehttps://helmetjs.github.io/ ↗