# helmet-crossdomain

> Set the X-Permitted-Cross-Domain-Policies header in Express apps

Latest version **0.5.0** (published 2019-09-01) · MIT license · 0 weekly downloads

## Install

```sh
npm install helmet-crossdomain
pnpm add helmet-crossdomain
yarn add helmet-crossdomain
bun add helmet-crossdomain
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.5.0 |
| Published | 2019-09-01 |
| First published | 2014-08-24 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=8.0.0 |
| Dependencies | 0 |
| Unpacked size | 5.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 11 |
| Author | Evan Hahn |
| Maintainers | evanhahn |
| Keywords | security, express, connect, crossdomain.xml, x-permitted-cross-domain-policies, flash |

## Links

- npm: https://www.npmjs.com/package/helmet-crossdomain
- Repository: https://github.com/helmetjs/crossdomain
- Homepage: https://helmetjs.github.io/docs/crossdomain/
- Issues: https://github.com/helmetjs/crossdomain/issues
- npm.io page: https://npm.io/package/helmet-crossdomain

## Alternatives

- [babylon](https://npm.io/package/babylon.md) — 5.1M weekly downloads
- [csscolorparser](https://npm.io/package/csscolorparser.md) — 3.7M weekly downloads
- [expr-eval-fork](https://npm.io/package/expr-eval-fork.md) — 1.5M weekly downloads
- [@leeoniya/ufuzzy](https://npm.io/package/@leeoniya/ufuzzy.md) — 247.7K weekly downloads
- [xml-parser](https://npm.io/package/xml-parser.md) — 78.4K weekly downloads

## Recent versions

- 0.5.0 (latest) — 2019-09-01
- 0.4.0 — 2019-06-15
- 0.3.0 — 2018-07-22
- 0.2.0 — 2018-02-16
- 0.1.0 — 2014-08-24

## README

X-Permitted-Cross-Domain-Policies middleware
============================================
[![Build Status](https://travis-ci.org/helmetjs/crossdomain.svg?branch=master)](https://travis-ci.org/helmetjs/crossdomain)

The `X-Permitted-Cross-Domain-Policies` header tells some web clients (like Adobe Flash or Adobe Acrobat) your domain's policy for loading cross-domain content. See the description on [OWASP](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-Permitted-Cross-Domain-Policies) for more.

Usage:

```javascript
const crossdomain = require('helmet-crossdomain')

// Sets X-Permitted-Cross-Domain-Policies: none
app.use(crossdomain())

// You can use any of the following values:
app.use(crossdomain({ permittedPolicies: 'none' }))
app.use(crossdomain({ permittedPolicies: 'master-only' }))
app.use(crossdomain({ permittedPolicies: 'by-content-type' }))
app.use(crossdomain({ permittedPolicies: 'all' }))
```

The `by-ftp-type` is not currently supported. Please open an issue or pull request if you desire this feature!

If you don't expect Adobe products to load data from your site, you get a minor security benefit by adding this header.

---
_Source: https://npm.io/package/helmet-crossdomain · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._