@middy/http-security-headers 3.0.0-alpha.0 → 3.0.0-alpha.1

package/index.js

@@ -0,0 +1,145 @@
+import { normalizeHttpResponse } from '@middy/util';
+const defaults = {
+  dnsPrefetchControl: {
+    allow: false
+  },
+  expectCT: {
+    enforce: true,
+    maxAge: 30,
+    reportUri: ''
+  },
+  frameguard: {
+    action: 'deny'
+  },
+  hidePoweredBy: {
+    setTo: null
+  },
+  hsts: {
+    maxAge: 180 * 24 * 60 * 60,
+    includeSubDomains: true,
+    preload: true
+  },
+  ieNoOpen: {
+    action: 'noopen'
+  },
+  noSniff: {
+    action: 'nosniff'
+  },
+  permittedCrossDomainPolicies: {
+    policy: 'none'
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  xssFilter: {
+    reportUri: ''
+  }
+};
+const helmet = {};
+const helmetHtmlOnly = {};
+
+helmet.dnsPrefetchControl = (headers, config) => {
+  headers['X-DNS-Prefetch-Control'] = config.allow ? 'on' : 'off';
+  return headers;
+};
+
+helmetHtmlOnly.frameguard = (headers, config) => {
+  headers['X-Frame-Options'] = config.action.toUpperCase();
+  return headers;
+};
+
+helmet.hidePoweredBy = (headers, config) => {
+  if (config.setTo) {
+    headers['X-Powered-By'] = config.setTo;
+  } else {
+    delete headers.Server;
+    delete headers['X-Powered-By'];
+  }
+
+  return headers;
+};
+
+helmet.hsts = (headers, config) => {
+  let header = 'max-age=' + Math.round(config.maxAge);
+
+  if (config.includeSubDomains) {
+    header += '; includeSubDomains';
+  }
+
+  if (config.preload) {
+    header += '; preload';
+  }
+
+  headers['Strict-Transport-Security'] = header;
+  return headers;
+};
+
+helmet.ieNoOpen = (headers, config) => {
+  headers['X-Download-Options'] = config.action;
+  return headers;
+};
+
+helmet.noSniff = (headers, config) => {
+  headers['X-Content-Type-Options'] = config.action;
+  return headers;
+};
+
+helmet.referrerPolicy = (headers, config) => {
+  headers['Referrer-Policy'] = config.policy;
+  return headers;
+};
+
+helmet.permittedCrossDomainPolicies = (headers, config) => {
+  headers['X-Permitted-Cross-Domain-Policies'] = config.policy;
+  return headers;
+};
+
+helmetHtmlOnly.xssFilter = (headers, config) => {
+  let header = '1; mode=block';
+
+  if (config.reportUri) {
+    header += '; report=' + config.reportUri;
+  }
+
+  headers['X-XSS-Protection'] = header;
+  return headers;
+};
+
+const httpSecurityHeadersMiddleware = (opts = {}) => {
+  const options = { ...defaults,
+    ...opts
+  };
+
+  const httpSecurityHeadersMiddlewareAfter = async request => {
+    var _request$response$hea;
+
+    normalizeHttpResponse(request);
+    Object.keys(helmet).forEach(key => {
+      const config = { ...defaults[key],
+        ...options[key]
+      };
+      request.response.headers = helmet[key](request.response.headers, config);
+    });
+
+    if ((_request$response$hea = request.response.headers['Content-Type']) !== null && _request$response$hea !== void 0 && _request$response$hea.includes('text/html')) {
+      Object.keys(helmetHtmlOnly).forEach(key => {
+        const config = { ...defaults[key],
+          ...options[key]
+        };
+        request.response.headers = helmetHtmlOnly[key](request.response.headers, config);
+      });
+    }
+  };
+
+  const httpSecurityHeadersMiddlewareOnError = async request => {
+    if (request.response === undefined) return;
+    return httpSecurityHeadersMiddlewareAfter(request);
+  };
+
+  return {
+    after: httpSecurityHeadersMiddlewareAfter,
+    onError: httpSecurityHeadersMiddlewareOnError
+  };
+};
+
+export default httpSecurityHeadersMiddleware;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@middy/http-security-headers",
-  "version": "3.0.0-alpha.0",
+  "version": "3.0.0-alpha.1",
   "description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
   "type": "module",
   "engines": {
@@ -13,6 +13,7 @@
   "exports": "./index.js",
   "types": "index.d.ts",
   "files": [
+    "index.js",
     "index.d.ts"
   ],
   "scripts": {
@@ -48,11 +49,11 @@
     "url": "https://github.com/middyjs/middy/issues"
   },
   "homepage": "https://github.com/middyjs/middy#readme",
-  "gitHead": "c533f62841c8a39d061d7b94f30ba178f002c8db",
+  "gitHead": "a14125c6b2e21b181824f9985a919a47f1e4711f",
   "dependencies": {
-    "@middy/util": "^3.0.0-alpha.0"
+    "@middy/util": "^3.0.0-alpha.1"
   },
   "devDependencies": {
-    "@middy/core": "^3.0.0-alpha.0"
+    "@middy/core": "^3.0.0-alpha.1"
   }
 }