owlwarden

Fix security headers are not configured in NestJS

The application does not set the baseline security response headers. Without them a browser will not enforce HTTPS, will guess content types, and will allow the page to be framed. Headers set by a CDN or ingress are invisible to static analysis, so this rule reports lower confidence when it finds no header configuration at all.

medium likely NestJS CWE-693 / OWASP A05:2021

The vulnerable pattern in NestJS

MEDIUM possible Security headers are not configured A05:2021 src/main.ts:9:21 7 │ 8 │ async function bootstrap() { 9 │ const app = await NestFactory.create(AppModule) │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ no security headers configured here 10 │ app.enableCors({ origin: true, credentials: true }) 11 │ await app.listen(3000)

This finding comes from the NestJS fixture in the owlwarden test suite. Without these headers the browser enforces nothing: strict-transport-security forces HTTPS for future requests; content-security-policy limits which scripts and origins the page may load; x-content-type-options stops browsers guessing a response's content type; x-frame-options blocks clickjacking via framing; referrer-policy stops URLs leaking to third parties.

The corrected handler

Register helmet in the bootstrap; it sets all of these.

import helmet from 'helmet'

const app = await NestFactory.create(AppModule)
app.use(helmet())

If you are not using NestJS

Set these response headers at the edge or in the app: strict-transport-security, content-security-policy, x-content-type-options, x-frame-options, referrer-policy.

Check your own repository

npx owlwarden scan
npx owlwarden explain security-headers-missing

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other NestJS checks

Rules with a tested NestJS example.

security-headers-missing for every framework / All rules / owlwarden