@boomerang-io/webapp-spa-server 1.0.2-beta.1 → 1.0.2-beta.2

package/index.js

@@ -60,12 +60,12 @@ function createBoomerangServer({
 
   // Security
   const helmet = require("helmet");
-  // app.use(
-  //   helmet({
-  //     contentSecurityPolicy: false,
-  //   })
-  // );
-  app.use(helmet());
+  app.use(
+    helmet({
+      referrerPolicy: { policy: "strict-origin-when-cross-origin" },
+      contentSecurityPolicy: false,
+    })
+  );
   app.disable("x-powered-by");
   app.use(cors(corsConfig));
 
@@ -106,7 +106,6 @@ function createBoomerangServer({
       )
     );
   } else {
-    logger.debug("1 - disableInjectHTMLHeadData: ", disableInjectHTMLHeadData);
     appRouter.use("/", express.static(path.join(process.cwd(), BUILD_DIR)));
   }
 
@@ -179,12 +178,12 @@ function injectEnvDataAndScriptsIntoHTML(
         }
       };
     </script>
-    <script src="//1.www.s81c.com/common/stats/ibm-common.js" type="text/javascript"></script>
+    <script src="https://1.www.s81c.com/common/stats/ibm-common.js" type="text/javascript" crossorigin></script>
     `
     : "";
 
   const headScriptBeeheardSurvey = Boolean(enableBeeheardSurvey)
-    ? '<script async src="https://beeheard.dal1a.cirrus.ibm.com/survey/preconfig/HHPxpQgN.js"></script>'
+    ? '<script async src="https://beeheard.dal1a.cirrus.ibm.com/survey/preconfig/HHPxpQgN.js" crossorigin></script>'
     : "";
 
   // Build up object of external data to append
@@ -217,7 +216,6 @@ function injectEnvDataAndScriptsIntoHTML(
    * @param {Buffer} chunk
    * @return {string} replaced string with data interopolated
    */
-  logger.debug("3 - GA script: ", headScripstGA);
   function addHeadData(chunk) {
     return chunk.toString().replace(
       "</head>",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@boomerang-io/webapp-spa-server",
   "description": "Webapp Server for React-based SPA w/ client-side routing",
-  "version": "1.0.2-beta.1",
+  "version": "1.0.2-beta.2",
   "author": {
     "name": "Tim Bula",
     "email": "timrbula@gmail.com"