@middy/http-security-headers 2.5.4 → 3.0.0-alpha.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2017-2021 Luciano Mammino, will Farrell and the [Middy team](https://github.com/middyjs/middy/graphs/contributors)
+Copyright (c) 2017-2022 Luciano Mammino, will Farrell and the [Middy team](https://github.com/middyjs/middy/graphs/contributors)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -77,7 +77,7 @@ Everyone is very welcome to contribute to this repository. Feel free to [raise i
 
 ## License
 
-Licensed under [MIT License](LICENSE). Copyright (c) 2017-2021 Luciano Mammino, will Farrell, and the [Middy team](https://github.com/middyjs/middy/graphs/contributors).
+Licensed under [MIT License](LICENSE). Copyright (c) 2017-2022 Luciano Mammino, will Farrell, and the [Middy team](https://github.com/middyjs/middy/graphs/contributors).
 
 <a href="https://app.fossa.io/projects/git%2Bgithub.com%2Fmiddyjs%2Fmiddy?ref=badge_large">
   <img src="https://app.fossa.io/api/projects/git%2Bgithub.com%2Fmiddyjs%2Fmiddy.svg?type=large" alt="FOSSA Status"  style="max-width:100%;">

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@middy/http-security-headers",
-  "version": "2.5.4",
+  "version": "3.0.0-alpha.0",
   "description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
-  "type": "commonjs",
+  "type": "module",
   "engines": {
-    "node": ">=12"
+    "node": ">=14"
   },
   "engineStrict": true,
   "publishConfig": {
     "access": "public"
   },
-  "main": "index.js",
+  "exports": "./index.js",
   "types": "index.d.ts",
   "files": [
     "index.d.ts"
@@ -48,11 +48,11 @@
     "url": "https://github.com/middyjs/middy/issues"
   },
   "homepage": "https://github.com/middyjs/middy#readme",
-  "gitHead": "a4134a579c757a9fdfed3006877ba2c0ec8a2cfa",
+  "gitHead": "c533f62841c8a39d061d7b94f30ba178f002c8db",
   "dependencies": {
-    "@middy/util": "^2.5.4"
+    "@middy/util": "^3.0.0-alpha.0"
   },
   "devDependencies": {
-    "@middy/core": "^2.5.4"
+    "@middy/core": "^3.0.0-alpha.0"
   }
 }

package/index.js

@@ -1,171 +0,0 @@
-"use strict";
-
-const {
-  normalizeHttpResponse
-} = require('@middy/util'); // Code and Defaults heavily based off https://helmetjs.github.io/
-
-
-const defaults = {
-  // contentDisposition: {
-  //   filename: undefined
-  // },
-  dnsPrefetchControl: {
-    allow: false
-  },
-  expectCT: {
-    enforce: true,
-    maxAge: 30,
-    reportUri: ''
-  },
-  frameguard: {
-    action: 'deny'
-  },
-  hidePoweredBy: {
-    setTo: null
-  },
-  hsts: {
-    maxAge: 180 * 24 * 60 * 60,
-    includeSubDomains: true,
-    preload: true
-  },
-  ieNoOpen: {
-    action: 'noopen'
-  },
-  noSniff: {
-    action: 'nosniff'
-  },
-  permittedCrossDomainPolicies: {
-    policy: 'none' // none, master-only, by-content-type, by-ftp-filename, all
-
-  },
-  referrerPolicy: {
-    policy: 'no-referrer'
-  },
-  xssFilter: {
-    reportUri: ''
-  }
-};
-const helmet = {};
-const helmetHtmlOnly = {}; // OWASP ASVS 14.4.2
-// API Gateway strips out this header :(
-// helmet.content = (headers, config) => {
-//   const filename = config.filename ?? `api.${headers?.['Content-Type'].split(/[/;]/)[1] ?? 'json'}`
-//   headers['Content-Disposition'] = `attachment; filename="${filename}"`
-// }
-// contentSecurityPolicy - N/A - no HTML
-// featurePolicy - N/A - no HTML
-// crossdomain - N/A - For Adobe products
-// https://github.com/helmetjs/dns-Prefetch-control
-
-helmet.dnsPrefetchControl = (headers, config) => {
-  headers['X-DNS-Prefetch-Control'] = config.allow ? 'on' : 'off';
-  return headers;
-}; // expectCt - in-progress spec
-// https://github.com/helmetjs/frameguard
-
-
-helmetHtmlOnly.frameguard = (headers, config) => {
-  headers['X-Frame-Options'] = config.action.toUpperCase();
-  return headers;
-}; // https://github.com/helmetjs/hide-powered-by
-
-
-helmet.hidePoweredBy = (headers, config) => {
-  if (config.setTo) {
-    headers['X-Powered-By'] = config.setTo;
-  } else {
-    Reflect.deleteProperty(headers, 'Server');
-    Reflect.deleteProperty(headers, 'X-Powered-By');
-  }
-
-  return headers;
-}; // hpkp - deprecated
-// https://github.com/helmetjs/hsts
-
-
-helmet.hsts = (headers, config) => {
-  let header = 'max-age=' + Math.round(config.maxAge);
-
-  if (config.includeSubDomains) {
-    header += '; includeSubDomains';
-  }
-
-  if (config.preload) {
-    header += '; preload';
-  }
-
-  headers['Strict-Transport-Security'] = header;
-  return headers;
-}; // https://github.com/helmetjs/ienoopen
-
-
-helmet.ieNoOpen = (headers, config) => {
-  headers['X-Download-Options'] = config.action;
-  return headers;
-}; // noCache - N/A - separate middleware
-// https://github.com/helmetjs/dont-sniff-mimetype
-
-
-helmet.noSniff = (headers, config) => {
-  headers['X-Content-Type-Options'] = config.action;
-  return headers;
-}; // https://github.com/helmetjs/referrer-policy
-
-
-helmet.referrerPolicy = (headers, config) => {
-  headers['Referrer-Policy'] = config.policy;
-  return headers;
-}; // https://github.com/helmetjs/crossdomain
-
-
-helmet.permittedCrossDomainPolicies = (headers, config) => {
-  headers['X-Permitted-Cross-Domain-Policies'] = config.policy;
-  return headers;
-}; // https://github.com/helmetjs/x-xss-protection
-
-
-helmetHtmlOnly.xssFilter = (headers, config) => {
-  let header = '1; mode=block';
-
-  if (config.reportUri) {
-    header += '; report=' + config.reportUri;
-  }
-
-  headers['X-XSS-Protection'] = header;
-  return headers;
-};
-
-const httpSecurityHeadersMiddleware = (opts = {}) => {
-  const options = { ...defaults,
-    ...opts
-  };
-
-  const httpSecurityHeadersMiddlewareAfter = async request => {
-    var _request$response$hea, _request$response$hea2;
-
-    request.response = normalizeHttpResponse(request.response);
-    Object.keys(helmet).forEach(key => {
-      const config = { ...defaults[key],
-        ...options[key]
-      };
-      request.response.headers = helmet[key](request.response.headers, config);
-    });
-
-    if ((_request$response$hea = request.response.headers) !== null && _request$response$hea !== void 0 && (_request$response$hea2 = _request$response$hea['Content-Type']) !== null && _request$response$hea2 !== void 0 && _request$response$hea2.includes('text/html')) {
-      Object.keys(helmetHtmlOnly).forEach(key => {
-        const config = { ...defaults[key],
-          ...options[key]
-        };
-        request.response.headers = helmetHtmlOnly[key](request.response.headers, config);
-      });
-    }
-  };
-
-  const httpSecurityHeadersMiddlewareOnError = httpSecurityHeadersMiddlewareAfter;
-  return {
-    after: httpSecurityHeadersMiddlewareAfter,
-    onError: httpSecurityHeadersMiddlewareOnError
-  };
-};
-
-module.exports = httpSecurityHeadersMiddleware;