@middy/http-security-headers 6.4.5 → 7.0.0-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +26 -33
  2. package/index.js +16 -23
  3. package/package.json +4 -4
package/README.md CHANGED
@@ -3,39 +3,32 @@
3
3
  <img alt="Middy logo" src="https://raw.githubusercontent.com/middyjs/middy/main/docs/img/middy-logo.svg"/>
4
4
  <p><strong>HTTP security headers middleware for the middy framework, the stylish Node.js middleware engine for AWS Lambda</strong></p>
5
5
  <p>Applies best practice security headers to responses. It's a simplified port of [HelmetJS](https://helmetjs.github.io/). See HelmetJS documentation for more details.</p>
6
- <p>
7
- <a href="https://www.npmjs.com/package/@middy/http-security-headers?activeTab=versions">
8
- <img src="https://badge.fury.io/js/%40middy%2Fhttp-security-headers.svg" alt="npm version" style="max-width:100%;">
9
- </a>
10
- <a href="https://packagephobia.com/result?p=@middy/http-security-headers">
11
- <img src="https://packagephobia.com/badge?p=@middy/http-security-headers" alt="npm install size" style="max-width:100%;">
12
- </a>
13
- <a href="https://github.com/middyjs/middy/actions/workflows/tests.yml">
14
- <img src="https://github.com/middyjs/middy/actions/workflows/tests.yml/badge.svg?branch=main&event=push" alt="GitHub Actions CI status badge" style="max-width:100%;">
15
- </a>
16
- <br/>
17
- <a href="https://standardjs.com/">
18
- <img src="https://img.shields.io/badge/code_style-standard-brightgreen.svg" alt="Standard Code Style" style="max-width:100%;">
19
- </a>
20
- <a href="https://snyk.io/test/github/middyjs/middy">
21
- <img src="https://snyk.io/test/github/middyjs/middy/badge.svg" alt="Known Vulnerabilities" data-canonical-src="https://snyk.io/test/github/middyjs/middy" style="max-width:100%;">
22
- </a>
23
- <a href="https://github.com/middyjs/middy/actions/workflows/sast.yml">
24
- <img src="https://github.com/middyjs/middy/actions/workflows/sast.yml/badge.svg
25
- ?branch=main&event=push" alt="CodeQL" style="max-width:100%;">
26
- </a>
27
- <a href="https://bestpractices.coreinfrastructure.org/projects/5280">
28
- <img src="https://bestpractices.coreinfrastructure.org/projects/5280/badge" alt="Core Infrastructure Initiative (CII) Best Practices" style="max-width:100%;">
29
- </a>
30
- <br/>
31
- <a href="https://gitter.im/middyjs/Lobby">
32
- <img src="https://badges.gitter.im/gitterHQ/gitter.svg" alt="Chat on Gitter" style="max-width:100%;">
33
- </a>
34
- <a href="https://stackoverflow.com/questions/tagged/middy?sort=Newest&uqlId=35052">
35
- <img src="https://img.shields.io/badge/StackOverflow-[middy]-yellow" alt="Ask questions on StackOverflow" style="max-width:100%;">
36
- </a>
37
- </p>
38
- <p>You can read the documentation at: <a href="https://middy.js.org/docs/middlewares//http-security-headers">https://middy.js.org/docs/middlewares//http-security-headers</a></p>
6
+ <p>
7
+ <a href="https://github.com/middyjs/middy/actions/workflows/test-unit.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-unit.yml/badge.svg" alt="GitHub Actions unit test status"></a>
8
+ <a href="https://github.com/middyjs/middy/actions/workflows/test-dast.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-dast.yml/badge.svg" alt="GitHub Actions dast test status"></a>
9
+ <a href="https://github.com/middyjs/middy/actions/workflows/test-perf.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-pref.yml/badge.svg" alt="GitHub Actions perf test status"></a>
10
+ <a href="https://github.com/middyjs/middy/actions/workflows/test-sast.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-sast.yml/badge.svg" alt="GitHub Actions SAST test status"></a>
11
+ <a href="https://github.com/middyjs/middy/actions/workflows/test-lint.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-lint.yml/badge.svg" alt="GitHub Actions lint test status"></a>
12
+ <br/>
13
+ <a href="https://www.npmjs.com/package/@middy/http-security-headers"><img alt="npm version" src="https://img.shields.io/npm/v/@middy/http-security-headers.svg"></a>
14
+ <a href="https://packagephobia.com/result?p=@middy/http-security-headers"><img src="https://packagephobia.com/badge?p=@middy/http-security-headers" alt="npm install size"></a>
15
+ <a href="https://www.npmjs.com/package/@middy/http-security-headers">
16
+ <img alt="npm weekly downloads" src="https://img.shields.io/npm/dw/@middy/http-security-headers.svg"></a>
17
+ <a href="https://www.npmjs.com/package/@middy/http-security-headers#provenance">
18
+ <img alt="npm provenance" src="https://img.shields.io/badge/provenance-Yes-brightgreen"></a>
19
+ <br/>
20
+ <a href="https://scorecard.dev/viewer/?uri=github.com/middyjs/middy"><img src="https://api.scorecard.dev/projects/github.com/middyjs/middy/badge" alt="Open Source Security Foundation (OpenSSF) Scorecard"></a>
21
+ <a href="https://slsa.dev"><img src="https://slsa.dev/images/gh-badge-level3.svg" alt="SLSA 3"></a>
22
+ <a href="https://github.com/middyjs/middy/blob/main/docs/CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg"></a>
23
+ <a href="https://biomejs.dev"><img alt="Checked with Biome" src="https://img.shields.io/badge/Checked_with-Biome-60a5fa?style=flat&logo=biome"></a>
24
+ <a href="https://conventionalcommits.org"><img alt="Conventional Commits" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white"></a>
25
+ <a href="https://github.com/middyjs/middy/blob/main/package.json#L32">
26
+ <img alt="code coverage" src="https://img.shields.io/badge/code%20coverage-95%25-brightgreen"></a>
27
+ <br/>
28
+ <a href="https://gitter.im/middyjs/Lobby"><img src="https://badges.gitter.im/gitterHQ/gitter.svg" alt="Chat on Gitter" style="max-width:100%;"></a>
29
+ <a href="https://stackoverflow.com/questions/tagged/middy?sort=Newest&uqlId=35052"><img src="https://img.shields.io/badge/StackOverflow-[middy]-yellow" alt="Ask questions on StackOverflow" style="max-width:100%;"></a>
30
+ </p>
31
+ <p>You can read the documentation at: <a href="https://middy.js.org/docs/middlewares/http-security-headers">https://middy.js.org/docs/middlewares/http-security-headers</a></p>
39
32
  </div>
40
33
 
41
34
  ## License
package/index.js CHANGED
@@ -7,7 +7,7 @@ const defaults = {
7
7
  // Fetch directives
8
8
  // 'child-src': '', // fallback default-src
9
9
  // 'connect-src': '', // fallback default-src
10
- "default-src": "'none'",
10
+ "default-src": "'none' 'report-sample' 'report-sha256'",
11
11
  // 'font-src':'', // fallback default-src
12
12
  // 'frame-src':'', // fallback child-src > default-src
13
13
  // 'img-src':'', // fallback default-src
@@ -30,7 +30,7 @@ const defaults = {
30
30
  "frame-ancestors": "'none'",
31
31
  "navigate-to": "'none'",
32
32
  // Reporting directives
33
- "report-to": "csp",
33
+ "report-to": "default",
34
34
  // Other directives
35
35
  "require-trusted-types-for": "'script'",
36
36
  "trusted-types": "'none'",
@@ -62,6 +62,7 @@ const defaults = {
62
62
  permissionsPolicy: {
63
63
  // Standard
64
64
  accelerometer: "",
65
+ "all-screens-capture": "",
65
66
  "ambient-light-sensor": "",
66
67
  autoplay: "",
67
68
  battery: "",
@@ -108,30 +109,21 @@ const defaults = {
108
109
  permittedCrossDomainPolicies: {
109
110
  policy: "none", // none, master-only, by-content-type, by-ftp-filename, all
110
111
  },
111
- poweredBy: {
112
- server: "",
113
- },
112
+ poweredBy: true,
114
113
  referrerPolicy: {
115
114
  policy: "no-referrer",
116
115
  },
117
116
  reportingEndpoints: {},
118
117
  reportTo: {
119
118
  maxAge: 365 * 24 * 60 * 60,
120
- // default: '',
121
119
  includeSubdomains: true,
122
- // csp: '',
123
- // permissions: '',
124
- // staple: '',
125
- // xss: ''
126
120
  },
127
121
  strictTransportSecurity: {
128
122
  maxAge: 180 * 24 * 60 * 60,
129
123
  includeSubDomains: true,
130
124
  preload: true,
131
125
  },
132
- xssProtection: {
133
- reportTo: "xss",
134
- },
126
+ xssProtection: false,
135
127
  };
136
128
 
137
129
  const helmet = {};
@@ -260,20 +252,13 @@ helmet.permittedCrossDomainPolicies = (headers, config) => {
260
252
 
261
253
  // https://github.com/helmetjs/hide-powered-by
262
254
  helmet.poweredBy = (headers, config) => {
263
- if (config.server) {
264
- headers["X-Powered-By"] = config.server;
265
- } else {
266
- headers.Server = undefined;
267
- headers["X-Powered-By"] = undefined;
268
- }
255
+ delete headers.Server;
256
+ delete headers["X-Powered-By"];
269
257
  };
270
258
 
271
259
  // https://github.com/helmetjs/x-xss-protection
272
260
  helmetHtmlOnly.xssProtection = (headers, config) => {
273
- let header = "1; mode=block";
274
- if (config.reportTo) {
275
- header += `; report=${config.reportTo}`;
276
- }
261
+ const header = "0";
277
262
  headers["X-XSS-Protection"] = header;
278
263
  };
279
264
 
@@ -305,6 +290,14 @@ const httpSecurityHeadersMiddleware = (opts = {}) => {
305
290
  }
306
291
  }
307
292
  }
293
+ // Clean up headers removals
294
+ const headers = {};
295
+ for (const key of Object.keys(request.response.headers)) {
296
+ if (typeof request.response.headers[key] !== "undefined") {
297
+ headers[key] = request.response.headers[key];
298
+ }
299
+ }
300
+ request.response.headers = headers;
308
301
  };
309
302
  const httpSecurityHeadersMiddlewareOnError = async (request) => {
310
303
  if (request.response === undefined) return;
package/package.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "name": "@middy/http-security-headers",
3
- "version": "6.4.5",
3
+ "version": "7.0.0-alpha.2",
4
4
  "description": "Applies best practice security headers to responses. It's a simplified port of HelmetJS",
5
5
  "type": "module",
6
6
  "engines": {
7
- "node": ">=20"
7
+ "node": ">=22"
8
8
  },
9
9
  "engineStrict": true,
10
10
  "publishConfig": {
@@ -68,9 +68,9 @@
68
68
  },
69
69
  "gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
70
70
  "dependencies": {
71
- "@middy/util": "6.4.5"
71
+ "@middy/util": "7.0.0-alpha.2"
72
72
  },
73
73
  "devDependencies": {
74
- "@middy/core": "6.4.5"
74
+ "@middy/core": "7.0.0-alpha.2"
75
75
  }
76
76
  }