@middy/http-security-headers 4.0.0 → 4.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +0 -57
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -37,63 +37,6 @@
|
|
|
37
37
|
<p>You can read the documentation at: <a href="https://middy.js.org/docs/middlewares//http-security-headers">https://middy.js.org/docs/middlewares//http-security-headers</a></p>
|
|
38
38
|
</div>
|
|
39
39
|
|
|
40
|
-
Applies best practice security headers to responses. It's a simplified port of HelmetJS. See [HelmetJS](https://helmetjs.github.io/) documentation for more details.
|
|
41
|
-
|
|
42
|
-
## Install
|
|
43
|
-
|
|
44
|
-
To install this middleware you can use NPM:
|
|
45
|
-
|
|
46
|
-
```bash
|
|
47
|
-
npm install --save @middy/http-security-headers
|
|
48
|
-
```
|
|
49
|
-
|
|
50
|
-
## Options
|
|
51
|
-
Setting an option to `false` to cause that rule to be ignored.
|
|
52
|
-
|
|
53
|
-
### All Responses
|
|
54
|
-
- `originAgentCluster`: Default to `{}` to include
|
|
55
|
-
- `referrerPolicy`: Default to `{ policy: 'no-referrer' }`
|
|
56
|
-
- `strictTransportSecurity`: Default to `{ maxAge: 15552000, includeSubDomains: true, preload: true }`
|
|
57
|
-
- X-`dnsPrefetchControl`: Default to `{ allow: false }`
|
|
58
|
-
- X-`downloadOptions`: Default to `{ action: 'noopen' }`
|
|
59
|
-
- X-`poweredBy`: Default to `{ server: '' }` to remove `Server` and `X-Powered-By`
|
|
60
|
-
- X-`contentTypeOptions`: Default to `{ action: 'nosniff' }`
|
|
61
|
-
### HTML Responses
|
|
62
|
-
- `contentSecurityPolicy`: Default to `{ 'default-src': "'none'", 'base-uri':"'none'", 'sandbox':'', 'form-action':"'none'", 'frame-ancestors':"'none'", 'navigate-to':"'none'", 'report-to':'csp', 'require-trusted-types-for':"'script'", 'trusted-types':"'none'", 'upgrade-insecure-requests':'' }`
|
|
63
|
-
- `crossOriginEmbedderPolicy`: Default to `{ policy: 'require-corp' }`
|
|
64
|
-
- `crossOriginOpenerPolicy`: Default to `{ policy: 'same-origin' }`
|
|
65
|
-
- `crossOriginResourcePolicy`: Default to `{ policy: 'same-origin' }`
|
|
66
|
-
- `permissionsPolicy`: Default to `{ *:'', ... }` where all allowed values are set to disable
|
|
67
|
-
- `reportTo`: Defaults to `{ maxAge: 31536000, default: '', includeSubdomains: true, csp: '', staple:'', xss: '' }` which won't report by default, needs setting
|
|
68
|
-
- X-`frameOptions`: Default to `{ action: 'deny' }`
|
|
69
|
-
- X-`xssProtection`: Defaults to `{ reportUri: '' }'`
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
## Sample usage
|
|
73
|
-
|
|
74
|
-
```javascript
|
|
75
|
-
import middy from '@middy/core'
|
|
76
|
-
import httpSecurityHeaders from '@middy/http-security-headers'
|
|
77
|
-
|
|
78
|
-
const handler = middy((event, context) => {
|
|
79
|
-
return {}
|
|
80
|
-
})
|
|
81
|
-
|
|
82
|
-
handler
|
|
83
|
-
.use(httpSecurityHeaders())
|
|
84
|
-
```
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
## Middy documentation and examples
|
|
88
|
-
|
|
89
|
-
For more documentation and examples, refers to the main [Middy monorepo on GitHub](https://github.com/middyjs/middy) or [Middy official website](https://middy.js.org).
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
## Contributing
|
|
93
|
-
|
|
94
|
-
Everyone is very welcome to contribute to this repository. Feel free to [raise issues](https://github.com/middyjs/middy/issues) or to [submit Pull Requests](https://github.com/middyjs/middy/pulls).
|
|
95
|
-
|
|
96
|
-
|
|
97
40
|
## License
|
|
98
41
|
|
|
99
42
|
Licensed under [MIT License](LICENSE). Copyright (c) 2017-2022 [Luciano Mammino](https://github.com/lmammino), [will Farrell](https://github.com/willfarrell), and the [Middy team](https://github.com/middyjs/middy/graphs/contributors).
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@middy/http-security-headers",
|
|
3
|
-
"version": "4.0.
|
|
3
|
+
"version": "4.0.2",
|
|
4
4
|
"description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"engines": {
|
|
@@ -64,11 +64,11 @@
|
|
|
64
64
|
"url": "https://github.com/middyjs/middy/issues"
|
|
65
65
|
},
|
|
66
66
|
"homepage": "https://middy.js.org",
|
|
67
|
-
"gitHead": "
|
|
67
|
+
"gitHead": "c77c9413ecb80999a71b67ff97edac1fed2ca754",
|
|
68
68
|
"dependencies": {
|
|
69
|
-
"@middy/util": "4.0.
|
|
69
|
+
"@middy/util": "4.0.2"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
|
-
"@middy/core": "4.0.
|
|
72
|
+
"@middy/core": "4.0.2"
|
|
73
73
|
}
|
|
74
74
|
}
|