Found disabled `EXPECT-CT` HeaderJS-S1006

Certificate Transparency (CT) is an open framework to protect against identity theft when certificates are issued. Certificate Authorities (CA) electronically sign the certificate after verifying the identity of the certificate owner. Attackers use, among other things, social engineering attacks to trick a CA into correctly verifying a spoofed identity/forged certificate.

Expect-CT as the name suggests checks for misuse of certificates. When a site enables the Expect-CT header, they are requesting that the browser check that any certificate for that site appears in public CT logs.

HelmetJS helps you secure your Express apps by setting various HTTP headers. helmet.expectCT sets the Expect-CT header. This prevents mis-issued SSL certificates. There are three parameters that you can use:

• maxAge – It determines the number of sections to expect Certificate Transparency.
• enforce – if true, the user agent should refuse future connections that violate the Certificate Transparency policy. If not set, it defaults to false.
• reportUri – if anything fails, it will report the failure to the URL supplied.

Bad Practice

const express = require('express')
const helmet = require('helmet')

let app = express()

app.use(
  helmet.expectCt({
    enforce: false
  })
)

Recommended

const express = require('express')
const helmet = require('helmet')

let app = express()

app.use(
  helmet.expectCt({
    enforce: true,
    maxAge: 86400
  })
)