Helmet expects an Express request object but koa-helmet passes it a Node request

[ide]

This is specifically a problem when Helmet is looking for fields on the request that a Node request doesn't have, like request.secure.

You can see this with the hsts() middleware which doesn't send the Strict-Transport-Security header since ctx.req.secure is always undefined. Passing in ctx.request fixes this specific issue, but there might not be a robust solution at hand since Koa request objects aren't guaranteed to be the same as Express request objects.

For the hsts() middleware, an easy workaround is to configure the middleware with { force: ctx.request.secure } but it's a little fragile that Helmet's logic for whether to send the HSTS response header needs to be replicated.

[EvanHahn]

Yeah, this one is tricky.

hsts is the only Helmet module that works better with Express request objects, so luckily it's only for that middleware.

You could wrap hsts and override the default setIf option, but I don't love the idea of special cases.

Happy to change something in Helmet if needed.