@middy/http-security-headers 5.5.1 → 6.0.0-beta.0

package/index.d.ts

@@ -29,6 +29,7 @@ interface Options {
     reportUri?: string
   }
   contentSecurityPolicy?: Record<string, string>
+  contentSecurityPolicyReportOnly?: boolean
   crossOriginEmbedderPolicy?: {
     policy?: string
   }
@@ -52,10 +53,10 @@ interface Options {
   }
 }
 
-type WithFalseValues<T> = { [K in keyof T]: T[K] | false }
+type WithBoolValues<T> = { [K in keyof T]: T[K] | boolean }
 
-declare function httpSecurityHeaders (
-  options?: WithFalseValues<Options>
+declare function httpSecurityHeaders(
+  options?: WithBoolValues<Options>
 ): middy.MiddlewareObj
 
 export default httpSecurityHeaders

package/index.js

@@ -36,6 +36,7 @@ const defaults = {
     'trusted-types': "'none'",
     'upgrade-insecure-requests': ''
   },
+  contentSecurityPolicyReportOnly: false,
   contentTypeOptions: {
     action: 'nosniff'
   },
@@ -113,13 +114,15 @@ const defaults = {
   referrerPolicy: {
     policy: 'no-referrer'
   },
+  reportingEndpoints: {},
   reportTo: {
     maxAge: 365 * 24 * 60 * 60,
-    default: '',
-    includeSubdomains: true,
-    csp: '',
-    staple: '',
-    xss: ''
+    // default: '',
+    includeSubdomains: true
+    // csp: '',
+    // permissions: '',
+    // staple: '',
+    // xss: ''
   },
   strictTransportSecurity: {
     maxAge: 180 * 24 * 60 * 60,
@@ -136,7 +139,7 @@ const helmetHtmlOnly = {}
 
 // *** https://github.com/helmetjs/helmet/tree/main/middlewares *** //
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
-helmetHtmlOnly.contentSecurityPolicy = (headers, config) => {
+helmetHtmlOnly.contentSecurityPolicy = (reportOnly) => (headers, config) => {
   let header = Object.keys(config)
     .map((policy) => (config[policy] ? `${policy} ${config[policy]}` : ''))
     .filter((str) => str)
@@ -147,7 +150,11 @@ helmetHtmlOnly.contentSecurityPolicy = (headers, config) => {
   if (config['upgrade-insecure-requests'] === '') {
     header += '; upgrade-insecure-requests'
   }
-  headers['Content-Security-Policy'] = header
+
+  const cspHeaderName = reportOnly
+    ? 'Content-Security-Policy-Report-Only'
+    : 'Content-Security-Policy'
+  headers[cspHeaderName] = header
 }
 // crossdomain - N/A - for Adobe products
 helmetHtmlOnly.crossOriginEmbedderPolicy = (headers, config) => {
@@ -182,9 +189,11 @@ helmet.referrerPolicy = (headers, config) => {
   headers['Referrer-Policy'] = config.policy
 }
 
+// DEPRECATED by reportingEndpoints
 helmetHtmlOnly.reportTo = (headers, config) => {
   headers['Report-To'] = Object.keys(config)
     .map((group) => {
+      if (group === 'includeSubdomains' || group === 'maxAge') return ''
       const includeSubdomains =
         group === 'default'
           ? `, "include_subdomains": ${config.includeSubdomains}`
@@ -197,6 +206,16 @@ helmetHtmlOnly.reportTo = (headers, config) => {
     .join(', ')
 }
 
+helmet.reportingEndpoints = (headers, config) => {
+  headers['Reporting-Endpoints'] = ''
+  const keys = Object.keys(config)
+  for (let i = 0, l = keys.length; i < l; i++) {
+    if (i) headers['Reporting-Endpoints'] += ', '
+    const key = keys[i]
+    headers['Reporting-Endpoints'] += key + '="' + config[key] + '"'
+  }
+}
+
 // https://github.com/helmetjs/hsts
 helmet.strictTransportSecurity = (headers, config) => {
   let header = 'max-age=' + Math.round(config.maxAge)
@@ -274,7 +293,14 @@ const httpSecurityHeadersMiddleware = (opts = {}) => {
       Object.keys(helmetHtmlOnly).forEach((key) => {
         if (!options[key]) return
         const config = { ...defaults[key], ...options[key] }
-        helmetHtmlOnly[key](request.response.headers, config)
+        if (key === 'contentSecurityPolicy') {
+          helmetHtmlOnly[key](options.contentSecurityPolicyReportOnly)(
+            request.response.headers,
+            config
+          )
+        } else {
+          helmetHtmlOnly[key](request.response.headers, config)
+        }
       })
     }
   }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@middy/http-security-headers",
-  "version": "5.5.1",
+  "version": "6.0.0-beta.0",
   "description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
   "type": "module",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "engineStrict": true,
   "publishConfig": {
@@ -16,6 +16,9 @@
       "import": {
         "types": "./index.d.ts",
         "default": "./index.js"
+      },
+      "require": {
+        "default": "./index.js"
       }
     }
   },
@@ -64,9 +67,9 @@
   },
   "gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
   "dependencies": {
-    "@middy/util": "5.5.1"
+    "@middy/util": "6.0.0-beta.0"
   },
   "devDependencies": {
-    "@middy/core": "5.5.1"
+    "@middy/core": "6.0.0-beta.0"
   }
 }