mediumBrowser protections

Missing Security Headers

Your Express/Hono application does not set security response headers.

Why it matters

Without security headers, browsers allow unsafe defaults: pages can be embedded in iframes (clickjacking), MIME types can be sniffed (content-type attacks), and connections can be downgraded to HTTP. The helmet middleware adds all recommended headers in one line.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Express app without security headers
const express = require('express');
const app = express();
app.get('/api/data', (req, res) => {
  res.json({ data: 'hello' });
});

The smallest fix

minimal patch
// Install and use helmet:
// npm install helmet
import helmet from 'helmet';
app.use(helmet());

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// Or set headers manually:
app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  res.setHeader('Content-Security-Policy', "default-src 'self'");
  next();
});

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] defines an Express/Hono app but does not set security headers. Add `helmet` middleware or manually set X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, and Content-Security-Policy.

How to check the fix worked

1. Make a request and check response headers include security headers
2. Verify X-Content-Type-Options is 'nosniff'
3. Run Mozilla Observatory scan against the app

Further reading