helmet-core 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +992 -0
  2. package/LICENSE +22 -0
  3. package/README.md +720 -0
  4. package/SECURITY.md +11 -0
  5. package/index.cjs +615 -0
  6. package/index.d.cts +134 -0
  7. package/index.d.mts +134 -0
  8. package/index.mjs +586 -0
  9. package/package.json +40 -0
package/index.d.cts ADDED
@@ -0,0 +1,134 @@
1
+ import {IncomingMessage, ServerResponse} from "node:http"
2
+
3
+ type ContentSecurityPolicyDirectiveValueFunction = (req: IncomingMessage, res: ServerResponse) => string
4
+ type ContentSecurityPolicyDirectiveValue = string | ContentSecurityPolicyDirectiveValueFunction
5
+ type ContentSecurityPolicyDirectives = Record<string, null | Iterable<ContentSecurityPolicyDirectiveValue> | typeof dangerouslyDisableDefaultSrc>
6
+ type ContentSecurityPolicyOptions = {
7
+ reportOnly?: boolean
8
+ } & (
9
+ | {
10
+ useDefaults?: true
11
+ directives?: ContentSecurityPolicyDirectives
12
+ }
13
+ | {
14
+ useDefaults: false
15
+ directives: ContentSecurityPolicyDirectives
16
+ }
17
+ )
18
+ type ContentSecurityPolicy = {
19
+ (options?: Readonly<ContentSecurityPolicyOptions>): (req: IncomingMessage, res: ServerResponse, next: (err?: Error) => void) => void
20
+ getDefaultDirectives: typeof getDefaultDirectives
21
+ dangerouslyDisableDefaultSrc: typeof dangerouslyDisableDefaultSrc
22
+ }
23
+ declare const dangerouslyDisableDefaultSrc: unique symbol
24
+ declare const getDefaultDirectives: () => Record<string, Iterable<ContentSecurityPolicyDirectiveValue>>
25
+ declare const contentSecurityPolicy: ContentSecurityPolicy
26
+
27
+ type CrossOriginEmbedderPolicyOptions = {
28
+ policy?: "require-corp" | "credentialless" | "unsafe-none"
29
+ }
30
+ declare function crossOriginEmbedderPolicy(options?: Readonly<CrossOriginEmbedderPolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
31
+
32
+ type CrossOriginOpenerPolicyOptions = {
33
+ policy?: "same-origin" | "same-origin-allow-popups" | "noopener-allow-popups" | "unsafe-none"
34
+ }
35
+ declare function crossOriginOpenerPolicy(options?: Readonly<CrossOriginOpenerPolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
36
+
37
+ type CrossOriginResourcePolicyOptions = {
38
+ policy?: "same-origin" | "same-site" | "cross-origin"
39
+ }
40
+ declare function crossOriginResourcePolicy(options?: Readonly<CrossOriginResourcePolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
41
+
42
+ declare function originAgentCluster(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
43
+
44
+ type ReferrerPolicyToken = "no-referrer" | "no-referrer-when-downgrade" | "same-origin" | "origin" | "strict-origin" | "origin-when-cross-origin" | "strict-origin-when-cross-origin" | "unsafe-url" | ""
45
+ type ReferrerPolicyOptions = {
46
+ policy?: ReferrerPolicyToken | ReferrerPolicyToken[]
47
+ }
48
+ declare function referrerPolicy(options?: Readonly<ReferrerPolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
49
+
50
+ type StrictTransportSecurityOptions = {
51
+ maxAge?: number
52
+ includeSubDomains?: boolean
53
+ preload?: boolean
54
+ }
55
+ declare function strictTransportSecurity(options?: Readonly<StrictTransportSecurityOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
56
+
57
+ declare function xContentTypeOptions(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
58
+
59
+ type XDnsPrefetchControlOptions = {
60
+ allow?: boolean
61
+ }
62
+ declare function xDnsPrefetchControl(options?: Readonly<XDnsPrefetchControlOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
63
+
64
+ declare function xDownloadOptions(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
65
+
66
+ type XFrameOptionsOptions = {
67
+ action?: "deny" | "sameorigin"
68
+ }
69
+ declare function xFrameOptions(options?: Readonly<XFrameOptionsOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
70
+
71
+ type XPermittedCrossDomainPoliciesOptions = {
72
+ permittedPolicies?: "none" | "master-only" | "by-content-type" | "all"
73
+ }
74
+ declare function xPermittedCrossDomainPolicies(options?: Readonly<XPermittedCrossDomainPoliciesOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
75
+
76
+ declare function xPoweredBy(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
77
+
78
+ declare function xXssProtection(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
79
+
80
+ type EitherKey<Key1 extends PropertyKey, Key2 extends PropertyKey, Value> =
81
+ | ({
82
+ [K in Key1]?: Value
83
+ } & {
84
+ [K in Key2]?: never
85
+ })
86
+ | ({
87
+ [K in Key1]?: never
88
+ } & {
89
+ [K in Key2]?: Value
90
+ })
91
+ type HelmetOptions = {
92
+ contentSecurityPolicy?: ContentSecurityPolicyOptions | boolean
93
+ crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicyOptions | boolean
94
+ crossOriginOpenerPolicy?: CrossOriginOpenerPolicyOptions | boolean
95
+ crossOriginResourcePolicy?: CrossOriginResourcePolicyOptions | boolean
96
+ originAgentCluster?: boolean
97
+ referrerPolicy?: ReferrerPolicyOptions | boolean
98
+ } & EitherKey<"strictTransportSecurity", "hsts", StrictTransportSecurityOptions | boolean> &
99
+ EitherKey<"xContentTypeOptions", "noSniff", boolean> &
100
+ EitherKey<"xDnsPrefetchControl", "dnsPrefetchControl", XDnsPrefetchControlOptions | boolean> &
101
+ EitherKey<"xDownloadOptions", "ieNoOpen", boolean> &
102
+ EitherKey<"xFrameOptions", "frameguard", XFrameOptionsOptions | boolean> &
103
+ EitherKey<"xPermittedCrossDomainPolicies", "permittedCrossDomainPolicies", XPermittedCrossDomainPoliciesOptions | boolean> &
104
+ EitherKey<"xPoweredBy", "hidePoweredBy", boolean> &
105
+ EitherKey<"xXssProtection", "xssFilter", boolean>
106
+ type Helmet = {
107
+ (options?: Readonly<HelmetOptions>): (req: IncomingMessage, res: ServerResponse, next: (err?: unknown) => void) => void
108
+ contentSecurityPolicy: typeof contentSecurityPolicy
109
+ crossOriginEmbedderPolicy: typeof crossOriginEmbedderPolicy
110
+ crossOriginOpenerPolicy: typeof crossOriginOpenerPolicy
111
+ crossOriginResourcePolicy: typeof crossOriginResourcePolicy
112
+ dnsPrefetchControl: typeof xDnsPrefetchControl
113
+ frameguard: typeof xFrameOptions
114
+ hidePoweredBy: typeof xPoweredBy
115
+ hsts: typeof strictTransportSecurity
116
+ ieNoOpen: typeof xDownloadOptions
117
+ noSniff: typeof xContentTypeOptions
118
+ originAgentCluster: typeof originAgentCluster
119
+ permittedCrossDomainPolicies: typeof xPermittedCrossDomainPolicies
120
+ referrerPolicy: typeof referrerPolicy
121
+ strictTransportSecurity: typeof strictTransportSecurity
122
+ xContentTypeOptions: typeof xContentTypeOptions
123
+ xDnsPrefetchControl: typeof xDnsPrefetchControl
124
+ xDownloadOptions: typeof xDownloadOptions
125
+ xFrameOptions: typeof xFrameOptions
126
+ xPermittedCrossDomainPolicies: typeof xPermittedCrossDomainPolicies
127
+ xPoweredBy: typeof xPoweredBy
128
+ xXssProtection: typeof xXssProtection
129
+ xssFilter: typeof xXssProtection
130
+ }
131
+ declare const helmet: Helmet
132
+
133
+ export {contentSecurityPolicy, crossOriginEmbedderPolicy, crossOriginOpenerPolicy, crossOriginResourcePolicy, helmet as default, xDnsPrefetchControl as dnsPrefetchControl, xFrameOptions as frameguard, xPoweredBy as hidePoweredBy, strictTransportSecurity as hsts, xDownloadOptions as ieNoOpen, xContentTypeOptions as noSniff, originAgentCluster, xPermittedCrossDomainPolicies as permittedCrossDomainPolicies, referrerPolicy, strictTransportSecurity, xContentTypeOptions, xDnsPrefetchControl, xDownloadOptions, xFrameOptions, xPermittedCrossDomainPolicies, xPoweredBy, xXssProtection, xXssProtection as xssFilter}
134
+ export type {HelmetOptions}
package/index.d.mts ADDED
@@ -0,0 +1,134 @@
1
+ import {IncomingMessage, ServerResponse} from "node:http"
2
+
3
+ type ContentSecurityPolicyDirectiveValueFunction = (req: IncomingMessage, res: ServerResponse) => string
4
+ type ContentSecurityPolicyDirectiveValue = string | ContentSecurityPolicyDirectiveValueFunction
5
+ type ContentSecurityPolicyDirectives = Record<string, null | Iterable<ContentSecurityPolicyDirectiveValue> | typeof dangerouslyDisableDefaultSrc>
6
+ type ContentSecurityPolicyOptions = {
7
+ reportOnly?: boolean
8
+ } & (
9
+ | {
10
+ useDefaults?: true
11
+ directives?: ContentSecurityPolicyDirectives
12
+ }
13
+ | {
14
+ useDefaults: false
15
+ directives: ContentSecurityPolicyDirectives
16
+ }
17
+ )
18
+ type ContentSecurityPolicy = {
19
+ (options?: Readonly<ContentSecurityPolicyOptions>): (req: IncomingMessage, res: ServerResponse, next: (err?: Error) => void) => void
20
+ getDefaultDirectives: typeof getDefaultDirectives
21
+ dangerouslyDisableDefaultSrc: typeof dangerouslyDisableDefaultSrc
22
+ }
23
+ declare const dangerouslyDisableDefaultSrc: unique symbol
24
+ declare const getDefaultDirectives: () => Record<string, Iterable<ContentSecurityPolicyDirectiveValue>>
25
+ declare const contentSecurityPolicy: ContentSecurityPolicy
26
+
27
+ type CrossOriginEmbedderPolicyOptions = {
28
+ policy?: "require-corp" | "credentialless" | "unsafe-none"
29
+ }
30
+ declare function crossOriginEmbedderPolicy(options?: Readonly<CrossOriginEmbedderPolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
31
+
32
+ type CrossOriginOpenerPolicyOptions = {
33
+ policy?: "same-origin" | "same-origin-allow-popups" | "noopener-allow-popups" | "unsafe-none"
34
+ }
35
+ declare function crossOriginOpenerPolicy(options?: Readonly<CrossOriginOpenerPolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
36
+
37
+ type CrossOriginResourcePolicyOptions = {
38
+ policy?: "same-origin" | "same-site" | "cross-origin"
39
+ }
40
+ declare function crossOriginResourcePolicy(options?: Readonly<CrossOriginResourcePolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
41
+
42
+ declare function originAgentCluster(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
43
+
44
+ type ReferrerPolicyToken = "no-referrer" | "no-referrer-when-downgrade" | "same-origin" | "origin" | "strict-origin" | "origin-when-cross-origin" | "strict-origin-when-cross-origin" | "unsafe-url" | ""
45
+ type ReferrerPolicyOptions = {
46
+ policy?: ReferrerPolicyToken | ReferrerPolicyToken[]
47
+ }
48
+ declare function referrerPolicy(options?: Readonly<ReferrerPolicyOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
49
+
50
+ type StrictTransportSecurityOptions = {
51
+ maxAge?: number
52
+ includeSubDomains?: boolean
53
+ preload?: boolean
54
+ }
55
+ declare function strictTransportSecurity(options?: Readonly<StrictTransportSecurityOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
56
+
57
+ declare function xContentTypeOptions(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
58
+
59
+ type XDnsPrefetchControlOptions = {
60
+ allow?: boolean
61
+ }
62
+ declare function xDnsPrefetchControl(options?: Readonly<XDnsPrefetchControlOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
63
+
64
+ declare function xDownloadOptions(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
65
+
66
+ type XFrameOptionsOptions = {
67
+ action?: "deny" | "sameorigin"
68
+ }
69
+ declare function xFrameOptions(options?: Readonly<XFrameOptionsOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
70
+
71
+ type XPermittedCrossDomainPoliciesOptions = {
72
+ permittedPolicies?: "none" | "master-only" | "by-content-type" | "all"
73
+ }
74
+ declare function xPermittedCrossDomainPolicies(options?: Readonly<XPermittedCrossDomainPoliciesOptions>): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
75
+
76
+ declare function xPoweredBy(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
77
+
78
+ declare function xXssProtection(): (_req: IncomingMessage, res: ServerResponse, next: () => void) => void
79
+
80
+ type EitherKey<Key1 extends PropertyKey, Key2 extends PropertyKey, Value> =
81
+ | ({
82
+ [K in Key1]?: Value
83
+ } & {
84
+ [K in Key2]?: never
85
+ })
86
+ | ({
87
+ [K in Key1]?: never
88
+ } & {
89
+ [K in Key2]?: Value
90
+ })
91
+ type HelmetOptions = {
92
+ contentSecurityPolicy?: ContentSecurityPolicyOptions | boolean
93
+ crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicyOptions | boolean
94
+ crossOriginOpenerPolicy?: CrossOriginOpenerPolicyOptions | boolean
95
+ crossOriginResourcePolicy?: CrossOriginResourcePolicyOptions | boolean
96
+ originAgentCluster?: boolean
97
+ referrerPolicy?: ReferrerPolicyOptions | boolean
98
+ } & EitherKey<"strictTransportSecurity", "hsts", StrictTransportSecurityOptions | boolean> &
99
+ EitherKey<"xContentTypeOptions", "noSniff", boolean> &
100
+ EitherKey<"xDnsPrefetchControl", "dnsPrefetchControl", XDnsPrefetchControlOptions | boolean> &
101
+ EitherKey<"xDownloadOptions", "ieNoOpen", boolean> &
102
+ EitherKey<"xFrameOptions", "frameguard", XFrameOptionsOptions | boolean> &
103
+ EitherKey<"xPermittedCrossDomainPolicies", "permittedCrossDomainPolicies", XPermittedCrossDomainPoliciesOptions | boolean> &
104
+ EitherKey<"xPoweredBy", "hidePoweredBy", boolean> &
105
+ EitherKey<"xXssProtection", "xssFilter", boolean>
106
+ type Helmet = {
107
+ (options?: Readonly<HelmetOptions>): (req: IncomingMessage, res: ServerResponse, next: (err?: unknown) => void) => void
108
+ contentSecurityPolicy: typeof contentSecurityPolicy
109
+ crossOriginEmbedderPolicy: typeof crossOriginEmbedderPolicy
110
+ crossOriginOpenerPolicy: typeof crossOriginOpenerPolicy
111
+ crossOriginResourcePolicy: typeof crossOriginResourcePolicy
112
+ dnsPrefetchControl: typeof xDnsPrefetchControl
113
+ frameguard: typeof xFrameOptions
114
+ hidePoweredBy: typeof xPoweredBy
115
+ hsts: typeof strictTransportSecurity
116
+ ieNoOpen: typeof xDownloadOptions
117
+ noSniff: typeof xContentTypeOptions
118
+ originAgentCluster: typeof originAgentCluster
119
+ permittedCrossDomainPolicies: typeof xPermittedCrossDomainPolicies
120
+ referrerPolicy: typeof referrerPolicy
121
+ strictTransportSecurity: typeof strictTransportSecurity
122
+ xContentTypeOptions: typeof xContentTypeOptions
123
+ xDnsPrefetchControl: typeof xDnsPrefetchControl
124
+ xDownloadOptions: typeof xDownloadOptions
125
+ xFrameOptions: typeof xFrameOptions
126
+ xPermittedCrossDomainPolicies: typeof xPermittedCrossDomainPolicies
127
+ xPoweredBy: typeof xPoweredBy
128
+ xXssProtection: typeof xXssProtection
129
+ xssFilter: typeof xXssProtection
130
+ }
131
+ declare const helmet: Helmet
132
+
133
+ export {contentSecurityPolicy, crossOriginEmbedderPolicy, crossOriginOpenerPolicy, crossOriginResourcePolicy, helmet as default, xDnsPrefetchControl as dnsPrefetchControl, xFrameOptions as frameguard, xPoweredBy as hidePoweredBy, strictTransportSecurity as hsts, xDownloadOptions as ieNoOpen, xContentTypeOptions as noSniff, originAgentCluster, xPermittedCrossDomainPolicies as permittedCrossDomainPolicies, referrerPolicy, strictTransportSecurity, xContentTypeOptions, xDnsPrefetchControl, xDownloadOptions, xFrameOptions, xPermittedCrossDomainPolicies, xPoweredBy, xXssProtection, xXssProtection as xssFilter}
134
+ export type {HelmetOptions}