@davaux/helmet 0.8.0 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +49 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +101 -0
- package/dist/index.js.map +1 -0
- package/package.json +6 -3
- package/CLAUDE.md +0 -95
- package/src/index.ts +0 -154
- package/tsconfig.json +0 -17
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
import type { MiddlewareFn } from 'davaux';
|
|
2
|
+
export interface CspOptions {
|
|
3
|
+
/**
|
|
4
|
+
* CSP directives. Each key is a directive name; the value is a string or
|
|
5
|
+
* array of source expressions.
|
|
6
|
+
*
|
|
7
|
+
* @example
|
|
8
|
+
* { 'script-src': ["'self'", 'https://cdn.example.com'] }
|
|
9
|
+
*/
|
|
10
|
+
directives?: Record<string, string | string[]>;
|
|
11
|
+
}
|
|
12
|
+
export interface HstsOptions {
|
|
13
|
+
/** Max-Age in seconds. Default: 15552000 (180 days) */
|
|
14
|
+
maxAge?: number;
|
|
15
|
+
/** Include subdomains. Default: true */
|
|
16
|
+
includeSubDomains?: boolean;
|
|
17
|
+
/** Add preload directive. Default: false */
|
|
18
|
+
preload?: boolean;
|
|
19
|
+
}
|
|
20
|
+
export interface HelmetOptions {
|
|
21
|
+
/** Content-Security-Policy. Pass `false` to disable. */
|
|
22
|
+
contentSecurityPolicy?: false | CspOptions;
|
|
23
|
+
/** Strict-Transport-Security. Pass `false` to disable. */
|
|
24
|
+
hsts?: false | HstsOptions;
|
|
25
|
+
/** X-Frame-Options. Pass `false` to disable. Default: 'SAMEORIGIN' */
|
|
26
|
+
xFrameOptions?: false | 'DENY' | 'SAMEORIGIN';
|
|
27
|
+
/** X-Content-Type-Options: nosniff. Pass `false` to disable. */
|
|
28
|
+
xContentTypeOptions?: false;
|
|
29
|
+
/** Referrer-Policy. Pass `false` to disable. */
|
|
30
|
+
referrerPolicy?: false | string;
|
|
31
|
+
/** Permissions-Policy. Pass `false` to disable. */
|
|
32
|
+
permissionsPolicy?: false | Record<string, string[]>;
|
|
33
|
+
/** X-DNS-Prefetch-Control: off. Pass `false` to disable. */
|
|
34
|
+
dnsPrefetchControl?: false;
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Security headers middleware. Sets a sensible set of HTTP security headers on
|
|
38
|
+
* every response — CSP, HSTS, X-Frame-Options, X-Content-Type-Options,
|
|
39
|
+
* Referrer-Policy, Permissions-Policy, and X-DNS-Prefetch-Control.
|
|
40
|
+
*
|
|
41
|
+
* All header values are pre-computed at middleware creation time, so there is
|
|
42
|
+
* zero per-request overhead. Pass `false` for any option to disable that header.
|
|
43
|
+
*
|
|
44
|
+
* @example
|
|
45
|
+
* import { helmet } from '@davaux/helmet'
|
|
46
|
+
* export default helmet({ hsts: false, xFrameOptions: 'DENY' })
|
|
47
|
+
*/
|
|
48
|
+
export declare function helmet(options?: HelmetOptions): MiddlewareFn;
|
|
49
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAI1C,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAA;IAC1C,0DAA0D;IAC1D,IAAI,CAAC,EAAE,KAAK,GAAG,WAAW,CAAA;IAC1B,sEAAsE;IACtE,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,YAAY,CAAA;IAC7C,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,KAAK,CAAA;IAC3B,gDAAgD;IAChD,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IAC/B,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,KAAK,CAAA;CAC3B;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,YAAY,CAShE"}
|
package/dist/index.js
ADDED
|
@@ -0,0 +1,101 @@
|
|
|
1
|
+
// ─── Defaults ─────────────────────────────────────────────────────────────────
|
|
2
|
+
const DEFAULT_CSP_DIRECTIVES = {
|
|
3
|
+
'default-src': ["'self'"],
|
|
4
|
+
'script-src': ["'self'"],
|
|
5
|
+
'style-src': ["'self'", "'unsafe-inline'"],
|
|
6
|
+
'img-src': ["'self'", 'data:'],
|
|
7
|
+
'font-src': ["'self'"],
|
|
8
|
+
'connect-src': ["'self'"],
|
|
9
|
+
'object-src': ["'none'"],
|
|
10
|
+
'base-uri': ["'self'"],
|
|
11
|
+
'form-action': ["'self'"],
|
|
12
|
+
};
|
|
13
|
+
const DEFAULT_PERMISSIONS = {
|
|
14
|
+
camera: [],
|
|
15
|
+
microphone: [],
|
|
16
|
+
geolocation: [],
|
|
17
|
+
payment: [],
|
|
18
|
+
};
|
|
19
|
+
// ─── Middleware ───────────────────────────────────────────────────────────────
|
|
20
|
+
/**
|
|
21
|
+
* Security headers middleware. Sets a sensible set of HTTP security headers on
|
|
22
|
+
* every response — CSP, HSTS, X-Frame-Options, X-Content-Type-Options,
|
|
23
|
+
* Referrer-Policy, Permissions-Policy, and X-DNS-Prefetch-Control.
|
|
24
|
+
*
|
|
25
|
+
* All header values are pre-computed at middleware creation time, so there is
|
|
26
|
+
* zero per-request overhead. Pass `false` for any option to disable that header.
|
|
27
|
+
*
|
|
28
|
+
* @example
|
|
29
|
+
* import { helmet } from '@davaux/helmet'
|
|
30
|
+
* export default helmet({ hsts: false, xFrameOptions: 'DENY' })
|
|
31
|
+
*/
|
|
32
|
+
export function helmet(options = {}) {
|
|
33
|
+
const headers = buildHeaders(options);
|
|
34
|
+
return async (ctx, next) => {
|
|
35
|
+
for (const [name, value] of headers) {
|
|
36
|
+
ctx.res.setHeader(name, value);
|
|
37
|
+
}
|
|
38
|
+
await next();
|
|
39
|
+
};
|
|
40
|
+
}
|
|
41
|
+
// Pre-compute the header map at middleware creation time — zero per-request overhead.
|
|
42
|
+
function buildHeaders(options) {
|
|
43
|
+
const headers = [];
|
|
44
|
+
// Content-Security-Policy
|
|
45
|
+
if (options.contentSecurityPolicy !== false) {
|
|
46
|
+
const directives = {
|
|
47
|
+
...DEFAULT_CSP_DIRECTIVES,
|
|
48
|
+
...(options.contentSecurityPolicy?.directives ?? {}),
|
|
49
|
+
};
|
|
50
|
+
const csp = Object.entries(directives)
|
|
51
|
+
.map(([k, v]) => {
|
|
52
|
+
const sources = Array.isArray(v) ? v : [v];
|
|
53
|
+
return sources.length ? `${k} ${sources.join(' ')}` : k;
|
|
54
|
+
})
|
|
55
|
+
.join('; ');
|
|
56
|
+
headers.push(['Content-Security-Policy', csp]);
|
|
57
|
+
}
|
|
58
|
+
// Strict-Transport-Security
|
|
59
|
+
if (options.hsts !== false) {
|
|
60
|
+
const hsts = options.hsts ?? {};
|
|
61
|
+
const maxAge = hsts.maxAge ?? 15552000;
|
|
62
|
+
let value = `max-age=${maxAge}`;
|
|
63
|
+
if (hsts.includeSubDomains !== false)
|
|
64
|
+
value += '; includeSubDomains';
|
|
65
|
+
if (hsts.preload)
|
|
66
|
+
value += '; preload';
|
|
67
|
+
headers.push(['Strict-Transport-Security', value]);
|
|
68
|
+
}
|
|
69
|
+
// X-Frame-Options
|
|
70
|
+
if (options.xFrameOptions !== false) {
|
|
71
|
+
headers.push(['X-Frame-Options', options.xFrameOptions ?? 'SAMEORIGIN']);
|
|
72
|
+
}
|
|
73
|
+
// X-Content-Type-Options
|
|
74
|
+
if (options.xContentTypeOptions !== false) {
|
|
75
|
+
headers.push(['X-Content-Type-Options', 'nosniff']);
|
|
76
|
+
}
|
|
77
|
+
// Referrer-Policy
|
|
78
|
+
if (options.referrerPolicy !== false) {
|
|
79
|
+
headers.push([
|
|
80
|
+
'Referrer-Policy',
|
|
81
|
+
typeof options.referrerPolicy === 'string'
|
|
82
|
+
? options.referrerPolicy
|
|
83
|
+
: 'strict-origin-when-cross-origin',
|
|
84
|
+
]);
|
|
85
|
+
}
|
|
86
|
+
// Permissions-Policy
|
|
87
|
+
if (options.permissionsPolicy !== false) {
|
|
88
|
+
const perms = options.permissionsPolicy ?? DEFAULT_PERMISSIONS;
|
|
89
|
+
const value = Object.entries(perms)
|
|
90
|
+
.map(([feature, allowlist]) => allowlist.length ? `${feature}=(${allowlist.join(' ')})` : `${feature}=()`)
|
|
91
|
+
.join(', ');
|
|
92
|
+
if (value)
|
|
93
|
+
headers.push(['Permissions-Policy', value]);
|
|
94
|
+
}
|
|
95
|
+
// X-DNS-Prefetch-Control
|
|
96
|
+
if (options.dnsPrefetchControl !== false) {
|
|
97
|
+
headers.push(['X-DNS-Prefetch-Control', 'off']);
|
|
98
|
+
}
|
|
99
|
+
return headers;
|
|
100
|
+
}
|
|
101
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAyCA,iFAAiF;AAEjF,MAAM,sBAAsB,GAA6B;IACvD,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC9B,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,aAAa,EAAE,CAAC,QAAQ,CAAC;CAC1B,CAAA;AAED,MAAM,mBAAmB,GAA6B;IACpD,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,OAAO,EAAE,EAAE;CACZ,CAAA;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAC,UAAyB,EAAE;IAChD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAErC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAsB;IAC1C,MAAM,OAAO,GAAuB,EAAE,CAAA;IAEtC,0BAA0B;IAC1B,IAAI,OAAO,CAAC,qBAAqB,KAAK,KAAK,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG;YACjB,GAAG,sBAAsB;YACzB,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,UAAU,IAAI,EAAE,CAAC;SACrD,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAA;QACtC,IAAI,KAAK,GAAG,WAAW,MAAM,EAAE,CAAA;QAC/B,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK;YAAE,KAAK,IAAI,qBAAqB,CAAA;QACpE,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,IAAI,WAAW,CAAA;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAA;IACpD,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAA;IACrD,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC;YACX,iBAAiB;YACjB,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;gBACxC,CAAC,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,iCAAiC;SACtC,CAAC,CAAA;IACJ,CAAC;IAED,qBAAqB;IACrB,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,IAAI,mBAAmB,CAAA;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,CAC5B,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAC3E;aACA,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@davaux/helmet",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.1",
|
|
4
4
|
"description": "Security headers middleware for Davaux",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"author": "David L Dyess II",
|
|
@@ -13,6 +13,9 @@
|
|
|
13
13
|
"url": "https://codeberg.org/davaux/davaux/issues"
|
|
14
14
|
},
|
|
15
15
|
"homepage": "https://codeberg.org/davaux/davaux#readme",
|
|
16
|
+
"files": [
|
|
17
|
+
"dist"
|
|
18
|
+
],
|
|
16
19
|
"exports": {
|
|
17
20
|
".": {
|
|
18
21
|
"import": "./dist/index.js",
|
|
@@ -24,11 +27,11 @@
|
|
|
24
27
|
"typecheck": "tsc --noEmit"
|
|
25
28
|
},
|
|
26
29
|
"peerDependencies": {
|
|
27
|
-
"davaux": ">=0.8.
|
|
30
|
+
"davaux": ">=0.8.1"
|
|
28
31
|
},
|
|
29
32
|
"devDependencies": {
|
|
30
33
|
"@types/node": "^25.0.0",
|
|
31
34
|
"davaux": "*",
|
|
32
35
|
"typescript": "^6.0.3"
|
|
33
36
|
}
|
|
34
|
-
}
|
|
37
|
+
}
|
package/CLAUDE.md
DELETED
|
@@ -1,95 +0,0 @@
|
|
|
1
|
-
<!-- pka-generated -->
|
|
2
|
-
# @davaux/helmet
|
|
3
|
-
|
|
4
|
-
> Generated by Project Knowledge Analyzer on 2026-06-06T21:53:10.269Z
|
|
5
|
-
|
|
6
|
-
## Overview
|
|
7
|
-
|
|
8
|
-
Security headers middleware for Davaux
|
|
9
|
-
|
|
10
|
-
**Version**: 0.8.0
|
|
11
|
-
**Author**: David L Dyess II
|
|
12
|
-
**License**: MIT
|
|
13
|
-
**Repository**: https://codeberg.org/davaux/davaux#readme
|
|
14
|
-
|
|
15
|
-
## Tech Stack
|
|
16
|
-
|
|
17
|
-
- **Language**: TypeScript
|
|
18
|
-
- **Module System**: ESM (`type: module`)
|
|
19
|
-
|
|
20
|
-
## Commands
|
|
21
|
-
|
|
22
|
-
- `npm run build` — tsc
|
|
23
|
-
- `npm run typecheck` — tsc --noEmit
|
|
24
|
-
|
|
25
|
-
## Project Structure
|
|
26
|
-
|
|
27
|
-
```
|
|
28
|
-
├── CLAUDE.md
|
|
29
|
-
├── README.md
|
|
30
|
-
├── package.json
|
|
31
|
-
├── tsconfig.json
|
|
32
|
-
└── src/
|
|
33
|
-
└── index.ts
|
|
34
|
-
|
|
35
|
-
```
|
|
36
|
-
|
|
37
|
-
## Entry Points
|
|
38
|
-
|
|
39
|
-
- `src/index.ts`
|
|
40
|
-
|
|
41
|
-
## Files by Type
|
|
42
|
-
|
|
43
|
-
### Documentation (2)
|
|
44
|
-
- `CLAUDE.md`
|
|
45
|
-
- `README.md`
|
|
46
|
-
|
|
47
|
-
### Config (2)
|
|
48
|
-
- `package.json`
|
|
49
|
-
- `tsconfig.json`
|
|
50
|
-
|
|
51
|
-
### Module (1)
|
|
52
|
-
- `src/index.ts`
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
## Git
|
|
56
|
-
- **Branch**: main
|
|
57
|
-
- **Last Commit**: chore: Add alpha status note to README
|
|
58
|
-
- **Author**: David Dyess II
|
|
59
|
-
- **Date**: 2026-06-06 15:52:27 -0600
|
|
60
|
-
- **Remote**: https://codeberg.org/davaux/davaux.git
|
|
61
|
-
|
|
62
|
-
### Recent Commits
|
|
63
|
-
```
|
|
64
|
-
f527031 chore: Add alpha status note to README
|
|
65
|
-
90c819e chore: Add repo info to package.json files
|
|
66
|
-
b200d9d feat(davaux)!: Add OmlCacheConfig - opt-in with includes option or opt-out with excludes option; Fix OML implementation to follow OML spec - use output instead of return
|
|
67
|
-
3bce0c2 chore: Update and add READMEs to packages; update ROADMAP
|
|
68
|
-
fc27c20 fix(davaux): Remove old dist folder on new builds; fix server port per DavauxConfig
|
|
69
|
-
c760659 feat(davaux): Add minify CSS in production builds
|
|
70
|
-
c899ab8 fix(davaux): Added method JS and JSX extenstion to scanner
|
|
71
|
-
7d99f04 feat(davaux): Add support for declarative partial updates
|
|
72
|
-
3b47f37 chore: Bump package versions to 0.8.0
|
|
73
|
-
aa0460f chore: Add CHANGELOG.md
|
|
74
|
-
```
|
|
75
|
-
|
|
76
|
-
## Dependencies
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
### Development
|
|
80
|
-
@types/node, davaux, typescript
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
## Exported Symbols
|
|
91
|
-
|
|
92
|
-
**`src/index.ts`**
|
|
93
|
-
`helmet`, `CspOptions`, `HstsOptions`, `HelmetOptions`
|
|
94
|
-
|
|
95
|
-
|
package/src/index.ts
DELETED
|
@@ -1,154 +0,0 @@
|
|
|
1
|
-
import type { MiddlewareFn } from 'davaux'
|
|
2
|
-
|
|
3
|
-
// ─── Options ──────────────────────────────────────────────────────────────────
|
|
4
|
-
|
|
5
|
-
export interface CspOptions {
|
|
6
|
-
/**
|
|
7
|
-
* CSP directives. Each key is a directive name; the value is a string or
|
|
8
|
-
* array of source expressions.
|
|
9
|
-
*
|
|
10
|
-
* @example
|
|
11
|
-
* { 'script-src': ["'self'", 'https://cdn.example.com'] }
|
|
12
|
-
*/
|
|
13
|
-
directives?: Record<string, string | string[]>
|
|
14
|
-
}
|
|
15
|
-
|
|
16
|
-
export interface HstsOptions {
|
|
17
|
-
/** Max-Age in seconds. Default: 15552000 (180 days) */
|
|
18
|
-
maxAge?: number
|
|
19
|
-
/** Include subdomains. Default: true */
|
|
20
|
-
includeSubDomains?: boolean
|
|
21
|
-
/** Add preload directive. Default: false */
|
|
22
|
-
preload?: boolean
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
export interface HelmetOptions {
|
|
26
|
-
/** Content-Security-Policy. Pass `false` to disable. */
|
|
27
|
-
contentSecurityPolicy?: false | CspOptions
|
|
28
|
-
/** Strict-Transport-Security. Pass `false` to disable. */
|
|
29
|
-
hsts?: false | HstsOptions
|
|
30
|
-
/** X-Frame-Options. Pass `false` to disable. Default: 'SAMEORIGIN' */
|
|
31
|
-
xFrameOptions?: false | 'DENY' | 'SAMEORIGIN'
|
|
32
|
-
/** X-Content-Type-Options: nosniff. Pass `false` to disable. */
|
|
33
|
-
xContentTypeOptions?: false
|
|
34
|
-
/** Referrer-Policy. Pass `false` to disable. */
|
|
35
|
-
referrerPolicy?: false | string
|
|
36
|
-
/** Permissions-Policy. Pass `false` to disable. */
|
|
37
|
-
permissionsPolicy?: false | Record<string, string[]>
|
|
38
|
-
/** X-DNS-Prefetch-Control: off. Pass `false` to disable. */
|
|
39
|
-
dnsPrefetchControl?: false
|
|
40
|
-
}
|
|
41
|
-
|
|
42
|
-
// ─── Defaults ─────────────────────────────────────────────────────────────────
|
|
43
|
-
|
|
44
|
-
const DEFAULT_CSP_DIRECTIVES: Record<string, string[]> = {
|
|
45
|
-
'default-src': ["'self'"],
|
|
46
|
-
'script-src': ["'self'"],
|
|
47
|
-
'style-src': ["'self'", "'unsafe-inline'"],
|
|
48
|
-
'img-src': ["'self'", 'data:'],
|
|
49
|
-
'font-src': ["'self'"],
|
|
50
|
-
'connect-src': ["'self'"],
|
|
51
|
-
'object-src': ["'none'"],
|
|
52
|
-
'base-uri': ["'self'"],
|
|
53
|
-
'form-action': ["'self'"],
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
const DEFAULT_PERMISSIONS: Record<string, string[]> = {
|
|
57
|
-
camera: [],
|
|
58
|
-
microphone: [],
|
|
59
|
-
geolocation: [],
|
|
60
|
-
payment: [],
|
|
61
|
-
}
|
|
62
|
-
|
|
63
|
-
// ─── Middleware ───────────────────────────────────────────────────────────────
|
|
64
|
-
|
|
65
|
-
/**
|
|
66
|
-
* Security headers middleware. Sets a sensible set of HTTP security headers on
|
|
67
|
-
* every response — CSP, HSTS, X-Frame-Options, X-Content-Type-Options,
|
|
68
|
-
* Referrer-Policy, Permissions-Policy, and X-DNS-Prefetch-Control.
|
|
69
|
-
*
|
|
70
|
-
* All header values are pre-computed at middleware creation time, so there is
|
|
71
|
-
* zero per-request overhead. Pass `false` for any option to disable that header.
|
|
72
|
-
*
|
|
73
|
-
* @example
|
|
74
|
-
* import { helmet } from '@davaux/helmet'
|
|
75
|
-
* export default helmet({ hsts: false, xFrameOptions: 'DENY' })
|
|
76
|
-
*/
|
|
77
|
-
export function helmet(options: HelmetOptions = {}): MiddlewareFn {
|
|
78
|
-
const headers = buildHeaders(options)
|
|
79
|
-
|
|
80
|
-
return async (ctx, next) => {
|
|
81
|
-
for (const [name, value] of headers) {
|
|
82
|
-
ctx.res.setHeader(name, value)
|
|
83
|
-
}
|
|
84
|
-
await next()
|
|
85
|
-
}
|
|
86
|
-
}
|
|
87
|
-
|
|
88
|
-
// Pre-compute the header map at middleware creation time — zero per-request overhead.
|
|
89
|
-
function buildHeaders(options: HelmetOptions): [string, string][] {
|
|
90
|
-
const headers: [string, string][] = []
|
|
91
|
-
|
|
92
|
-
// Content-Security-Policy
|
|
93
|
-
if (options.contentSecurityPolicy !== false) {
|
|
94
|
-
const directives = {
|
|
95
|
-
...DEFAULT_CSP_DIRECTIVES,
|
|
96
|
-
...(options.contentSecurityPolicy?.directives ?? {}),
|
|
97
|
-
}
|
|
98
|
-
const csp = Object.entries(directives)
|
|
99
|
-
.map(([k, v]) => {
|
|
100
|
-
const sources = Array.isArray(v) ? v : [v]
|
|
101
|
-
return sources.length ? `${k} ${sources.join(' ')}` : k
|
|
102
|
-
})
|
|
103
|
-
.join('; ')
|
|
104
|
-
headers.push(['Content-Security-Policy', csp])
|
|
105
|
-
}
|
|
106
|
-
|
|
107
|
-
// Strict-Transport-Security
|
|
108
|
-
if (options.hsts !== false) {
|
|
109
|
-
const hsts = options.hsts ?? {}
|
|
110
|
-
const maxAge = hsts.maxAge ?? 15552000
|
|
111
|
-
let value = `max-age=${maxAge}`
|
|
112
|
-
if (hsts.includeSubDomains !== false) value += '; includeSubDomains'
|
|
113
|
-
if (hsts.preload) value += '; preload'
|
|
114
|
-
headers.push(['Strict-Transport-Security', value])
|
|
115
|
-
}
|
|
116
|
-
|
|
117
|
-
// X-Frame-Options
|
|
118
|
-
if (options.xFrameOptions !== false) {
|
|
119
|
-
headers.push(['X-Frame-Options', options.xFrameOptions ?? 'SAMEORIGIN'])
|
|
120
|
-
}
|
|
121
|
-
|
|
122
|
-
// X-Content-Type-Options
|
|
123
|
-
if (options.xContentTypeOptions !== false) {
|
|
124
|
-
headers.push(['X-Content-Type-Options', 'nosniff'])
|
|
125
|
-
}
|
|
126
|
-
|
|
127
|
-
// Referrer-Policy
|
|
128
|
-
if (options.referrerPolicy !== false) {
|
|
129
|
-
headers.push([
|
|
130
|
-
'Referrer-Policy',
|
|
131
|
-
typeof options.referrerPolicy === 'string'
|
|
132
|
-
? options.referrerPolicy
|
|
133
|
-
: 'strict-origin-when-cross-origin',
|
|
134
|
-
])
|
|
135
|
-
}
|
|
136
|
-
|
|
137
|
-
// Permissions-Policy
|
|
138
|
-
if (options.permissionsPolicy !== false) {
|
|
139
|
-
const perms = options.permissionsPolicy ?? DEFAULT_PERMISSIONS
|
|
140
|
-
const value = Object.entries(perms)
|
|
141
|
-
.map(([feature, allowlist]) =>
|
|
142
|
-
allowlist.length ? `${feature}=(${allowlist.join(' ')})` : `${feature}=()`,
|
|
143
|
-
)
|
|
144
|
-
.join(', ')
|
|
145
|
-
if (value) headers.push(['Permissions-Policy', value])
|
|
146
|
-
}
|
|
147
|
-
|
|
148
|
-
// X-DNS-Prefetch-Control
|
|
149
|
-
if (options.dnsPrefetchControl !== false) {
|
|
150
|
-
headers.push(['X-DNS-Prefetch-Control', 'off'])
|
|
151
|
-
}
|
|
152
|
-
|
|
153
|
-
return headers
|
|
154
|
-
}
|
package/tsconfig.json
DELETED
|
@@ -1,17 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"compilerOptions": {
|
|
3
|
-
"target": "ESNext",
|
|
4
|
-
"module": "NodeNext",
|
|
5
|
-
"moduleResolution": "NodeNext",
|
|
6
|
-
"strict": true,
|
|
7
|
-
"declaration": true,
|
|
8
|
-
"declarationMap": true,
|
|
9
|
-
"sourceMap": true,
|
|
10
|
-
"outDir": "./dist",
|
|
11
|
-
"rootDir": "./src",
|
|
12
|
-
"skipLibCheck": true,
|
|
13
|
-
"lib": ["ESNext"],
|
|
14
|
-
"types": ["node"]
|
|
15
|
-
},
|
|
16
|
-
"include": ["src/**/*"]
|
|
17
|
-
}
|