Integrate helmet approach as default about kretes HOT 2 CLOSED

I had a look at this one, and it's not that easy to implement it given helmet is for express/connect apps, and this one seems to have a different approach.

There's an easier way of just setting few headers:

X-Frame-Options SAMEORIGIN;
X-Content-Type-Options nosniff;
X-XSS-Protection "1; mode=block";

CSP is a harder topic:

Content-Security-Policy "default-src 'self'";

Definitely not ideal, but gives some basic security easily.

from kretes.

@emilos Yes, I'd prefer we take a «good enough» approach. Often it's too easy and time consuming to try to come up with the ideal solution. In README we should state potential shortcomings.

By the way, in Huncwot it's possible to reuse Express/Connect middlewares, but I'd prefer to integrate them directly into our core than using it as a dependency. I know it's an extreme approach, but long term it'll make things easier. ;)

from kretes.