helmet-csp

library4.0.0jsnpmunverified

Content Security Policy middleware for Express and Node.js. Version 4.0.0 requires Node >=18 and ships TypeScript definitions. It sets the Content-Security-Policy header using a directives object with support for camelCase or kebab-case keys, dynamic values via functions, and a default policy that can be overridden or disabled. Unlike generic CSP libraries, it integrates directly with the Helmet ecosystem and provides sensible defaults to prevent common vulnerabilities like XSS, though it performs minimal validation on the policy itself.

auth-security web-framework

npm install helmet-csp

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · HELMET-CSP

helmet-csp

auth-securityjavascriptv4.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (contentSecurityPolicy)

✓ const csp = require('helmet-csp')

✗ import csp from 'helmet-csp'

This package is CommonJS only; default export is a function. TypeScript users can use `import csp = require('helmet-csp')`.

contentSecurityPolicy

✓ const { contentSecurityPolicy } = require('helmet-csp')

✗ import { contentSecurityPolicy } from 'helmet-csp'

The named export exists only as an alias to the default export. Same CommonJS restriction.

getDefaultDirectives

✓ const { getDefaultDirectives } = require('helmet-csp')

✗ import { getDefaultDirectives } from 'helmet-csp'

Available as a named export, but CommonJS only. Returns the default directives object.

Configures Express with Content Security Policy middleware using custom directives and dynamic nonce.

Debug

Known issues

breakingIn version 4.0.0, the package is no longer a submodule of helmet. It must be installed separately.

fix

Install via npm install helmet-csp and import separately from helmet.

affects: >=4.0.0

breakingTypeScript types are now included but require Node >=18. Older Node versions will not work.

fix

Upgrade Node to version 18 or higher.

affects: >=4.0.0

gotchaThe package performs very little validation on CSP directives. Use external tools like CSP Evaluator.

fix

Validate your CSP policy with CSP Evaluator or similar before deploying.

affects: *

gotchaSetting `useDefaults: false` disables the built-in defaults completely, which may create an insecure policy.

fix

Ensure you explicitly define all required directives when disabling defaults, specially defaultSrc.

affects: *

deprecatedThe `Content-Security-Policy-Report-Only` mode via `reportOnly: true` is deprecated in favor of using separate headers.

fix

Use the `report-uri` or `report-to` directives instead, or set the header manually.

affects: >=4.0.0

Errors

Common errors & fixes

Error: Cannot find module 'helmet-csp'

Package not installed or imported incorrectly.

fix

Run `npm install helmet-csp` and use `require('helmet-csp')`.

TypeError: contentSecurityPolicy is not a function

Wrong import style; must use default export with require.

fix

Use `const csp = require('helmet-csp');` and call `csp({...})`.

Error: Invalid directive: 'default-src'

Mixing camelCase and kebab-case or using unknown directive.

fix

Use valid directive names like `defaultSrc` (camelCase) or `default-src` (kebab-case).

Upgrade

Version history

4.0.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/helmetjs/helmet ↗

packagehttps://www.npmjs.com/package/helmet-csp ↗

homepagehttps://helmetjs.github.io ↗