Cant we have Security Configuration Wrapped up along with the Express Framework?

[shravan20]

Greetings Express team!

I would like to propose an idea, where we have the complete security configuration for building the Secure Express application, rather than them as a separate package stay dependent on them.

[dougwilson]

Duplicate of #3437

[shravan20]

Not including helmet or any other in the express base, rather, we can define our sec standards, taking inspiration from the helmet and helmet like packages.

[dougwilson]

Hi @shravan20 yes, that is certainly true! I think the main point of discussion would be a few points on that:

1. Who is going to do this work, and commit to indefinitely maintaining it? I certainly don't have any more room to maintain anything additional than what I already am.
2. What exactly are these security features that should be added? It is hard to really even discuss 1 without a specific list of each thing.
3. And finally, security packages are very exposed to of course scrutiny from security professionals, issuing many CVEs and requiring very quick triaging and excellent domain knowledge to ensure they are truly adding security and not subtly broken in some manor. This is of course why we point to packages like helmet as they are battle-tested and have the folks like that already working on it.

[bjohansebas]

What’s great about Express is how minimalistic it is, and how easy it is to extend with other middlewares that the community can create. So I don't think that’s something good to include, and it adds the additional burden of maintenance.