@middy/http-security-headers 5.0.2 → 5.1.0

package/index.js

@@ -1,35 +1,13 @@
 import { normalizeHttpResponse } from '@middy/util';
-// Code and Defaults heavily based off https://helmetjs.github.io/
 const defaults = {
     contentSecurityPolicy: {
-        // Fetch directives
-        // 'child-src': '', // fallback default-src
-        // 'connect-src': '', // fallback default-src
         'default-src': "'none'",
-        // 'font-src':'', // fallback default-src
-        // 'frame-src':'', // fallback child-src > default-src
-        // 'img-src':'', // fallback default-src
-        // 'manifest-src':'', // fallback default-src
-        // 'media-src':'', // fallback default-src
-        // 'object-src':'', // fallback default-src
-        // 'prefetch-src':'', // fallback default-src
-        // 'script-src':'', // fallback default-src
-        // 'script-src-elem':'', // fallback script-src > default-src
-        // 'script-src-attr':'', // fallback script-src > default-src
-        // 'style-src':'', // fallback default-src
-        // 'style-src-elem':'', // fallback style-src > default-src
-        // 'style-src-attr':'', // fallback style-src > default-src
-        // 'worker-src':'', // fallback child-src > script-src > default-src
-        // Document directives
         'base-uri': "'none'",
         sandbox: '',
-        // Navigation directives
         'form-action': "'none'",
         'frame-ancestors': "'none'",
         'navigate-to': "'none'",
-        // Reporting directives
         'report-to': 'csp',
-        // Other directives
         'require-trusted-types-for': "'script'",
         'trusted-types': "'none'",
         'upgrade-insecure-requests': ''
@@ -57,7 +35,6 @@ const defaults = {
     },
     originAgentCluster: {},
     permissionsPolicy: {
-        // Standard
         accelerometer: '',
         'ambient-light-sensor': '',
         autoplay: '',
@@ -85,12 +62,10 @@ const defaults = {
         usb: '',
         'web-share': '',
         'xr-spatial-tracking': '',
-        // Proposed
         'clipboard-read': '',
         'clipboard-write': '',
         gamepad: '',
         'speaker-selection': '',
-        // Experimental
         'conversion-measurement': '',
         'focus-without-user-activation': '',
         hid: '',
@@ -103,7 +78,7 @@ const defaults = {
         'vertical-scroll': ''
     },
     permittedCrossDomainPolicies: {
-        policy: 'none' // none, master-only, by-content-type, by-ftp-filename, all
+        policy: 'none'
     },
     poweredBy: {
         server: ''
@@ -130,8 +105,6 @@ const defaults = {
 };
 const helmet = {};
 const helmetHtmlOnly = {};
-// *** https://github.com/helmetjs/helmet/tree/main/middlewares *** //
-// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
 helmetHtmlOnly.contentSecurityPolicy = (headers, config)=>{
     let header = Object.keys(config).map((policy)=>config[policy] ? `${policy} ${config[policy]}` : '').filter((str)=>str).join('; ');
     if (config.sandbox === '') {
@@ -142,7 +115,6 @@ helmetHtmlOnly.contentSecurityPolicy = (headers, config)=>{
     }
     headers['Content-Security-Policy'] = header;
 };
-// crossdomain - N/A - for Adobe products
 helmetHtmlOnly.crossOriginEmbedderPolicy = (headers, config)=>{
     headers['Cross-Origin-Embedder-Policy'] = config.policy;
 };
@@ -152,16 +124,12 @@ helmetHtmlOnly.crossOriginOpenerPolicy = (headers, config)=>{
 helmetHtmlOnly.crossOriginResourcePolicy = (headers, config)=>{
     headers['Cross-Origin-Resource-Policy'] = config.policy;
 };
-// DEPRECATED: expectCt
-// DEPRECATED: hpkp
-// https://www.permissionspolicy.com/
 helmetHtmlOnly.permissionsPolicy = (headers, config)=>{
     headers['Permissions-Policy'] = Object.keys(config).map((policy)=>`${policy}=${config[policy] === '*' ? '*' : '(' + config[policy] + ')'}`).join(', ');
 };
 helmet.originAgentCluster = (headers, config)=>{
     headers['Origin-Agent-Cluster'] = '?1';
 };
-// https://github.com/helmetjs/referrer-policy
 helmet.referrerPolicy = (headers, config)=>{
     headers['Referrer-Policy'] = config.policy;
 };
@@ -171,7 +139,6 @@ helmetHtmlOnly.reportTo = (headers, config)=>{
         return config[group] && group !== 'includeSubdomains' ? `{ "group": "default", "max_age": ${config.maxAge}, "endpoints": [ { "url": "${config[group]}" } ]${includeSubdomains} }` : '';
     }).filter((str)=>str).join(', ');
 };
-// https://github.com/helmetjs/hsts
 helmet.strictTransportSecurity = (headers, config)=>{
     let header = 'max-age=' + Math.round(config.maxAge);
     if (config.includeSubDomains) {
@@ -182,29 +149,21 @@ helmet.strictTransportSecurity = (headers, config)=>{
     }
     headers['Strict-Transport-Security'] = header;
 };
-// noCache - N/A - separate middleware
-// X-* //
-// https://github.com/helmetjs/dont-sniff-mimetype
 helmet.contentTypeOptions = (headers, config)=>{
     headers['X-Content-Type-Options'] = config.action;
 };
-// https://github.com/helmetjs/dns-Prefetch-control
 helmet.dnsPrefetchControl = (headers, config)=>{
     headers['X-DNS-Prefetch-Control'] = config.allow ? 'on' : 'off';
 };
-// https://github.com/helmetjs/ienoopen
 helmet.downloadOptions = (headers, config)=>{
     headers['X-Download-Options'] = config.action;
 };
-// https://github.com/helmetjs/frameOptions
 helmetHtmlOnly.frameOptions = (headers, config)=>{
     headers['X-Frame-Options'] = config.action.toUpperCase();
 };
-// https://github.com/helmetjs/crossdomain
 helmet.permittedCrossDomainPolicies = (headers, config)=>{
     headers['X-Permitted-Cross-Domain-Policies'] = config.policy;
 };
-// https://github.com/helmetjs/hide-powered-by
 helmet.poweredBy = (headers, config)=>{
     if (config.server) {
         headers['X-Powered-By'] = config.server;
@@ -213,7 +172,6 @@ helmet.poweredBy = (headers, config)=>{
         delete headers['X-Powered-By'];
     }
 };
-// https://github.com/helmetjs/x-xss-protection
 helmetHtmlOnly.xssProtection = (headers, config)=>{
     let header = '1; mode=block';
     if (config.reportTo) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@middy/http-security-headers",
-  "version": "5.0.2",
+  "version": "5.1.0",
   "description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
   "type": "module",
   "engines": {
@@ -62,11 +62,11 @@
     "type": "github",
     "url": "https://github.com/sponsors/willfarrell"
   },
-  "gitHead": "6d17e155237022f2a0abd095ac7cd99ebfc7fc71",
+  "gitHead": "bbdaf5843914921804ba085dd58117273febe6b5",
   "dependencies": {
-    "@middy/util": "5.0.2"
+    "@middy/util": "5.1.0"
   },
   "devDependencies": {
-    "@middy/core": "5.0.2"
+    "@middy/core": "5.1.0"
   }
 }