@fastify/helmet

Security headers plugin for Fastify — sets HTTP headers that protect against common web vulnerabilities like XSS, clickjacking, and MIME sniffing.

@fastify/helmet

Fastify

Security headers plugin for Fastify — sets HTTP headers that protect against common web vulnerabilities like XSS, clickjacking, and MIME sniffing.

npmGitHubDocs

Fit

Bundle (gzip)

4.4 kB

15.0 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

By default, Fastify (and Node.js HTTP servers generally) set no security-related response headers. This exposes apps to clickjacking, MIME sniffing, and XSS attacks that a few HTTP headers can prevent.

What It Does

@fastify/helmet is the Fastify wrapper around the helmet library. It sets Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and other protective headers by default. Each header is configurable or can be disabled individually.

Installation

bash
npm install @fastify/helmet

Usage Example

typescript
import fastify from 'fastify';
import helmet from '@fastify/helmet';

const app = fastify();

await app.register(helmet, {
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'", 'cdn.example.com'],
      imgSrc: ["'self'", 'data:', 'https:'],
    },
  },
});

Related packages

@fastify/autoloadFastify

Auto-load Fastify plugins from a directory — organize routes and plugins as files and let the framework discover them automatically.

@fastify/cookieFastify

Plugin for Fastify that adds support for reading and setting cookies, including signed cookies.

@fastify/corsFastify

CORS plugin for Fastify — configure cross-origin resource sharing with full support for preflight requests and dynamic origins.

@fastify/jwtFastify

JWT authentication plugin for Fastify — sign, verify, and decode tokens with a decorator-based API that integrates with Fastify's request lifecycle.

@fastify/multipartFastify

Multipart form data / file upload plugin for Fastify — stream files directly to storage without buffering in memory.