Helmet not handling thrown errors about helmet HOT 2 CLOSED

I think this is just how Express works.

If the middleware chain is interrupted by an error, the rest won't get executed. For example:

app.use((req, res, next) => {
  throw new Error("Error!");
});

app.use((req, res) => {
  res.send("This will never be called!!");
});

app.use((err, req, res, next) => {
  res.send("There was an error");
});

Helmet doesn't do anything special here.

If you want to get around this, you can:

1. Put Helmet before any middleware that might fail to ensure it's always run.

   app.use(helmet());
   
   app.use(middlewareThatMightThrow);

2. Convert Helmet to an error-style middleware.

   const helmetMiddleware = helmet();
   
   app.use((err, req, res, next) => {
     helmetMiddleware(req, res, (helmetError) => {
       next(helmetError ?? err);
     });
   });
   
   app.use(middlewareThatMightThrow);
   
   app.use(helmet());
   
   app.use((err, req, res, next) => {
     res.send("There was an error");
   });

Does this help?

from helmet.

I'm going to close this issue because I think I've answered your question. Let me know if that's wrong and I'll reopen.

from helmet.