---
title: Express application should use Helmet
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Express application should use Helmet
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Express application should use Helmet

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `typescript-express/missing-helmet`

**Language:** TypeScript

**Severity:** Warning

**Category:** Security

**CWE**: [693](https://cwe.mitre.org/data/definitions/693.html)

## Description{% #description %}

Per [Express documentation](https://expressjs.com/en/advanced/best-practice-security.html#use-helmet):

[Helmet](https://helmetjs.github.io/) can help protect your app from some well-known web vulnerabilities by setting HTTP headers appropriately.

This rule will check whether you've set `app.use(helmet())` within the file that you've called `express()`

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```typescript
import express, { Express, Request, Response } from 'express';

const app: Express = express();

// no `app.use(helmet())` helmet detected in the file

app.get("/foo", (req: Request, res: Response) => res.send("foo"));

app.listen(8000);
```

## Compliant Code Examples{% #compliant-code-examples %}

```typescript
import express from 'express';
import helmet from 'helmet';



const MyController = express();
MyController.use(helmet());

MyController.listen(8000);
```

```typescript
import express, { Express, Request, Response } from 'express';
import helmet from "helmet";

const app: Express = express();

app.use(helmet()); // helmet detected

app.get("/foo", (req: Request, res: Response) => res.send("foo"));

app.listen(8000);
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}