MEDIUM AI PREVALENCE: MEDIUM auth.express.helmet-disabled-protection

A Helmet security header is explicitly turned off.

CWE-693 OWASP A05:2021 js · ts

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Passing contentSecurityPolicy: false, hsts: false, frameguard: false, or noSniff: false to helmet() disables a protection Helmet enables by default: CSP (XSS/data-injection defense), HSTS (forces HTTPS), X-Frame-Options (clickjacking defense), or X-Content-Type-Options (MIME sniffing defense) respectively.

Remove the false override so the default protection stays on, or replace it with a real configuration object (for example contentSecurityPolicy: { directives: { ... } } or hsts: { maxAge: 31536000 }). If a header genuinely must be managed elsewhere, set it there rather than shipping the response with the protection silently missing.

VULNERABLE

vulnerable.ts

import express from 'express';
import helmet from 'helmet';

const app = express();

// ruleid: auth.express.helmet-disabled-protection
app.use(helmet({ contentSecurityPolicy: false }));

// ruleid: auth.express.helmet-disabled-protection
app.use(helmet({ hsts: false }));

// ruleid: auth.express.helmet-disabled-protection
app.use(helmet({ frameguard: false, hidePoweredBy: true }));

// ruleid: auth.express.helmet-disabled-protection
app.use(helmet({ noSniff: false }));

SAFE

safe.ts

import express from 'express';
import helmet from 'helmet';

const app = express();

// ok: auth.express.helmet-disabled-protection -- all defaults on
app.use(helmet());

// ok: auth.express.helmet-disabled-protection -- CSP configured, not disabled
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: { defaultSrc: ["'self'"] },
    },
  }),
);

// ok: auth.express.helmet-disabled-protection -- HSTS tuned, not disabled
app.use(helmet({ hsts: { maxAge: 31536000, includeSubDomains: true } }));

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.express.helmet-disabled-protection -- <reason>

References

https://helmetjs.github.io/ ↗https://cwe.mitre.org/data/definitions/693.html ↗