ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
A fresh Express server ships with almost no security headers. KrakenJS's Helmet middleware fixes that with one line — here's what it sets, how to tune the CSP per route, and where it falls short.
KrakenJS includes the Helmet middleware to automatically apply a Content Security Policy header. By default, the injected CSP omits a script-src directive, which permits all scripts unless the developer adds one explicitly. The goal is to determine whether KrakenJS should supply a default script-src value that balances security with developer ergonomics. Con
express
krakenjs