@defra/lis-infra-ui-services 0.29.0 → 0.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defra/lis-infra-ui-services",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "UI-Services shared definitions for the livestock taxonomy topology.",
   "main": "src/index.js",
   "repository": {
@@ -34,6 +34,7 @@
     "./proxy/setup-proxy": "./src/proxy/setup-proxy.js",
     "./redis-client": "./src/redis-client.js",
     "./referrer-link": "./src/referrer-link.js",
+    "./security-headers": "./src/security-headers.js",
     "./session-cache": "./src/session-cache.js",
     "./session-cache/cache-engine": "./src/session-cache/cache-engine.js",
     "./static-files": "./src/static-files.js",

package/src/security-headers.js

@@ -0,0 +1,40 @@
+/** @import { Plugin } from '@hapi/hapi' */
+
+const HSTS_MAX_AGE_SECONDS = 31536000 // one year
+
+// Response headers that complement the CSP. HSTS pins HTTPS, nosniff stops MIME
+// sniffing, and the referrer/permissions policies limit what the browser leaks
+// and which powerful features a page may use. Referrer-Policy is "same-origin"
+// so same-origin referers still reach resolveHubOrigin's referer fallback while
+// cross-origin referer leakage is cut.
+const SECURITY_HEADERS = {
+  'strict-transport-security': `max-age=${HSTS_MAX_AGE_SECONDS}; includeSubDomains`,
+  'x-content-type-options': 'nosniff',
+  'referrer-policy': 'same-origin',
+  'permissions-policy': 'camera=(), microphone=(), geolocation=()'
+}
+
+/**
+ * Hapi plugin that sets a fixed set of hardening headers on every response,
+ * including Boom error responses.
+ * @type {{ plugin: Plugin<void> }}
+ */
+export const securityHeaders = {
+  plugin: {
+    name: 'lis-security-headers',
+    register(server) {
+      server.ext('onPreResponse', (request, h) => {
+        const { response } = request
+        const headers = response.isBoom
+          ? response.output.headers
+          : response.headers
+
+        for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+          headers[name] = value
+        }
+
+        return h.continue
+      })
+    }
+  }
+}

package/src/security-headers.test.js

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict'
+import hapi from '@hapi/hapi'
+import { test } from 'vitest'
+
+import { securityHeaders } from './security-headers.js'
+
+async function buildServer() {
+  const server = hapi.server()
+  await server.register(securityHeaders)
+  server.route({ method: 'GET', path: '/ok', handler: () => 'ok' })
+  server.route({
+    method: 'GET',
+    path: '/boom',
+    handler: () => {
+      throw new Error('nope')
+    }
+  })
+  return server
+}
+
+test('sets the hardening headers on a normal response', async () => {
+  const server = await buildServer()
+
+  const { statusCode, headers } = await server.inject('/ok')
+
+  assert.equal(statusCode, 200)
+  assert.equal(
+    headers['strict-transport-security'],
+    'max-age=31536000; includeSubDomains'
+  )
+  assert.equal(headers['x-content-type-options'], 'nosniff')
+  assert.equal(headers['referrer-policy'], 'same-origin')
+  assert.equal(
+    headers['permissions-policy'],
+    'camera=(), microphone=(), geolocation=()'
+  )
+})
+
+test('sets the hardening headers on a Boom error response', async () => {
+  const server = await buildServer()
+
+  const { statusCode, headers } = await server.inject('/boom')
+
+  assert.equal(statusCode, 500)
+  assert.equal(headers['x-content-type-options'], 'nosniff')
+  assert.equal(headers['referrer-policy'], 'same-origin')
+  assert.equal(
+    headers['strict-transport-security'],
+    'max-age=31536000; includeSubDomains'
+  )
+})

package/src/session-cache.js

@@ -1,10 +1,10 @@
 import yar from '@hapi/yar'
 
 /**
- * @param {{ sessionConfig: object, isSecure: boolean }} options
+ * @param {{ sessionConfig: object }} options
  * @returns {object}
  */
-export function createSessionCachePlugin({ sessionConfig, isSecure }) {
+export function createSessionCachePlugin({ sessionConfig }) {
   return {
     plugin: yar,
     options: {
@@ -18,7 +18,9 @@ export function createSessionCachePlugin({ sessionConfig, isSecure }) {
       cookieOptions: {
         password: sessionConfig.cookie.password,
         ttl: sessionConfig.cookie.ttl,
-        isSecure,
+        // Secure is a fixed invariant: the browser always reaches the app over
+        // HTTPS (Caddy locally, the CDP edge deployed).
+        isSecure: true,
         isSameSite: 'Lax',
         clearInvalid: true
       }
@@ -32,7 +34,6 @@ export function createSessionCachePlugin({ sessionConfig, isSecure }) {
  */
 export function createSessionCachePluginForConfig(config) {
   return createSessionCachePlugin({
-    sessionConfig: config.get('session'),
-    isSecure: config.get('session.cookie.secure')
+    sessionConfig: config.get('session')
   })
 }

package/src/session-cache.test.js

@@ -19,7 +19,7 @@ test('createSessionCachePlugin builds the expected yar plugin options', () => {
     }
   }
 
-  const plugin = createSessionCachePlugin({ sessionConfig, isSecure: true })
+  const plugin = createSessionCachePlugin({ sessionConfig })
 
   assert.equal(plugin.plugin, yar)
   assert.deepEqual(plugin.options, {
@@ -58,20 +58,16 @@ test('createSessionCachePluginForConfig maps config values into the plugin', ()
           }
         }
       }
-
-      if (key === 'session.cookie.secure') {
-        return false
-      }
     }
   }
 
   const plugin = createSessionCachePluginForConfig(config)
 
-  assert.deepEqual(calls, ['session', 'session.cookie.secure'])
+  assert.deepEqual(calls, ['session'])
   assert.equal(plugin.options.name, 'mapped-session')
   assert.equal(plugin.options.cache.expiresIn, 1000)
   assert.equal(plugin.options.cookieOptions.password, 'secret')
   assert.equal(plugin.options.cookieOptions.ttl, 2000)
-  assert.equal(plugin.options.cookieOptions.isSecure, false)
+  assert.equal(plugin.options.cookieOptions.isSecure, true)
   assert.equal(plugin.options.cookieOptions.isSameSite, 'Lax')
 })