Express 5 + Helmet + express-rate-limit hardening: working versions (tested 2026-10-15)

{
  "name": "express-helmet-rate-limit",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "helmet": "8.3.0",
    "express-rate-limit": "8.7.1"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "supertest": "7.3.1",
    "@types/supertest": "7.2.1",
    "@types/express": "5.0.6"
  }
}

import express from "express";
import helmet from "helmet";
import { rateLimit } from "express-rate-limit";

export function createApp({ limit = 100, windowMs = 60_000 } = {}) {
  const app = express();
  app.use(helmet());
  app.use("/api", rateLimit({ windowMs, limit, standardHeaders: "draft-8", legacyHeaders: false }));
  app.get("/api/ping", (_req, res) => { res.json({ ok: true }); });
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import request from "supertest";
import { createApp } from "../src/app.ts";

test("sets security headers", async () => {
  const res = await request(createApp()).get("/api/ping");
  assert.equal(res.status, 200);
  assert.equal(res.headers["x-content-type-options"], "nosniff");
  assert.ok(res.headers["content-security-policy"]);
  assert.equal(res.headers["x-powered-by"], undefined);
});

test("returns 429 after the limit", async () => {
  const app = createApp({ limit: 2 });
  await request(app).get("/api/ping").expect(200);
  await request(app).get("/api/ping").expect(200);
  const res = await request(app).get("/api/ping");
  assert.equal(res.status, 429);
  assert.ok(res.headers["ratelimit"] || res.headers["ratelimit-policy"]);
});