Can't seem to disable frameguard on specific route

I have helmet configured like this:

const app = express()

app.use(helmet())
// ...
app.use('/specificRoute', helmet.frameguard(false), (req, res) => { /* ... */ })

I also tried using helmet({ frameguard: false }) but had the same result - I still get the X-Frame-Options: SAMEORIGIN header.

[EvanHahn]

app.use(helmet()) sets the X-Frame-Options header, and Helmet doesn’t have any mechanisms for undoing these headers. You could do something like this:

const app = express()

app.use(helmet())

function removeFrameguard (req, res, next) {
  req.removeHeader('X-Frame-Options')
  next()
}

app.use('/specificRoute', removeFrameguard, (req, res) => { /* ... */ })

Does that help?

[Billy-]

I think you meant res.removeHeader rather than req.removeHeader 😉

Conditional middleware in Express seems uncommon enough that it’s not worth baking into the library. It seems like something that needs to be handled at the Express level—either built into Express or as a more general plugin. Does that make sense?

No, not really sure why you would say that, but maybe I’m missing something?

Disabling further down the line seems like a perfectly valid use-case; turn it on as a blanket-statement, then turn it off only as an exception. Shouldn’t be too hard to check if action === false in frameguard and if so res.removeHeader('X-Frame-Options').