4bnode 4.1.6 → 4.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "4bnode",
-  "version": "4.1.6",
+  "version": "4.1.7",
   "description": "4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.",
   "main": "index.js",
   "type": "module",

package/skeleton/index.js

@@ -50,13 +50,31 @@ app.use(cors({ origin: "*" }));
 // ── Security (built-in by default) ───────────────────
 // Mounted AFTER the /_dev dashboard so its CDN/inline scripts aren't blocked by
 // helmet's CSP and the dashboard isn't throttled by the rate limiter.
-app.use(helmet());
+// helmet() defaults to a strict Content-Security-Policy (script-src 'self',
+// etc.) that blocks CDN-loaded scripts, inline <script> blocks, and cross-origin
+// assets. We widen the policy so a typical frontend/docs page works while keeping
+// the rest of helmet's protections. Tighten these directives for production.
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      imgSrc: ["'self'", 'data:', 'https:'],
+      connectSrc: ["'self'"],
+    },
+  },
+  crossOriginEmbedderPolicy: false,
+  // Allow other origins (e.g. a separate frontend host) to load assets served
+  // by this app. Default is 'same-origin'. Tighten to 'same-site' for production.
+  crossOriginResourcePolicy: { policy: 'cross-origin' },
+}));
 
 // ── Rate limiting ────────────────────────────────────
 // Tune via .env: RATE_LIMIT_WINDOW_MS (ms) and RATE_LIMIT_MAX (per window).
 const apiLimiter = rateLimit({
   windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
-  max: Number(process.env.RATE_LIMIT_MAX) || 100,
+  max: Number(process.env.RATE_LIMIT_MAX) || 500,
   standardHeaders: true,
   legacyHeaders: false,
 });