nuxt-security-module 4.4.0 → 4.5.0

package/README.md

@@ -5,7 +5,7 @@
 [![NPM downloads][badge-npm-downloads]][url-npm]
 [![NPM Unpacked Size (with version)][badge-npm-unpacked-size]][url-npm]
 
-A Nuxt security module for [Nitro 3](https://nitro.build) and h3 2 that sets security headers on rendered pages, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.
+This package is a Nuxt security module for [Nitro 3](https://nitro.build) and h3 2 that sets security headers on rendered pages. It also provides a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.
 
 Design notes live in [the specs](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module).
 
@@ -51,6 +51,18 @@ export default defineNuxtConfig({
 });
 ```
 
+A request's body limit is the one its route sets, whatever its `Content-Type` claims, since a client writes that header. A route that takes a larger body names its own limit in its route rule:
+
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  routeRules: {
+    // Lets a request to this route carry a 10 MB body, where the rest of the app takes the 2 MB default
+    "/api/import/**": { security: { requestSizeLimiter: { maxRequestSizeInBytes: 10_000_000 } } },
+  },
+});
+```
+
 ## <a name="license">⚖️ License</a>
 
 Licensed under [Apache-2.0][url-license].

package/dist/constants.js

@@ -0,0 +1,7 @@
+import { MODULE_NAME } from "./runtime/constants.js";
+// src/constants.ts
+const ROUTE_RULES_TEMPLATE_FILENAME = `#${MODULE_NAME}/route-rules.mjs`;
+const SRI_HASHES_TEMPLATE_FILENAME = `#${MODULE_NAME}/sri-hashes.mjs`;
+const ROUTE_RULES_PLUGIN_FILENAME = `#${MODULE_NAME}/route-rules-plugin.mjs`;
+const SRI_PLUGIN_FILENAME = `#${MODULE_NAME}/sri-plugin.mjs`;
+export { ROUTE_RULES_PLUGIN_FILENAME, ROUTE_RULES_TEMPLATE_FILENAME, SRI_HASHES_TEMPLATE_FILENAME, SRI_PLUGIN_FILENAME };

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+import { ModuleOptions } from "./models/ModuleOptions.js";
+import { SecurityRouteRules } from "./models/SecurityRouteRules.js";
+import { NuxtModule } from "@nuxt/schema";
+declare module "@nuxt/schema" {
+  interface NuxtConfig {
+    security?: Partial<ModuleOptions>;
+  }
+}
+declare module "h3/rules" {
+  interface RouteRuleConfig {
+    security?: SecurityRouteRules;
+  }
+}
+declare const securityModule: NuxtModule<Partial<ModuleOptions>>;
+export { type ModuleOptions, securityModule as default };

package/dist/index.js

@@ -0,0 +1,101 @@
+import { ROUTE_RULES_PLUGIN_FILENAME, ROUTE_RULES_TEMPLATE_FILENAME, SRI_HASHES_TEMPLATE_FILENAME, SRI_PLUGIN_FILENAME } from "./constants.js";
+import { MODULE_NAME } from "./runtime/constants.js";
+import { checkIsRecord } from "./runtime/services/checkIsRecord.js";
+import { computeSubresourceIntegrityHashes } from "./services/computeSubresourceIntegrityHashes.js";
+import { getDefaultModuleOptions } from "./services/getDefaultModuleOptions.js";
+import { getPluginTemplate } from "./services/getPluginTemplate.js";
+import { getRemoveLoggersViteConfig } from "./services/getRemoveLoggersViteConfig.js";
+import { getRouteRulesTemplate } from "./services/getRouteRulesTemplate.js";
+import { getRouteSecurityRules } from "./services/getRouteSecurityRules.js";
+import { getStaticResourceHeaders } from "./services/getStaticResourceHeaders.js";
+import { getTypeTemplate } from "./services/getTypeTemplate.js";
+import { mergeModuleOptions } from "./services/mergeModuleOptions.js";
+import { parseModuleOptions } from "./services/parseModuleOptions.js";
+import { defu } from "defu";
+import { addNitroPlugin, addServerHandler, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
+// src/module.ts
+const securityModule = defineNuxtModule({
+	meta: {
+		compatibility: { nuxt: ">=5.0.0-0" },
+		configKey: "security",
+		name: MODULE_NAME
+	},
+	setup(userOptions, nuxt) {
+		const options = parseModuleOptions(mergeModuleOptions(getDefaultModuleOptions(nuxt.options.dev, nuxt.options.devServer.url, userOptions.strict === true), userOptions));
+		if (!options.enabled) return;
+		const resolver = createResolver(import.meta.url);
+		const { basicAuth, ...publicOptions } = options;
+		if (basicAuth) {
+			const { private: privateRuntimeConfig } = nuxt.options.runtimeConfig;
+			nuxt.options.runtimeConfig.private = defu(checkIsRecord(privateRuntimeConfig) ? privateRuntimeConfig : {}, { basicAuth });
+		}
+		const routeSecurityRules = getRouteSecurityRules(nuxt.options.routeRules ?? {}, options);
+		addServerTemplate({
+			filename: ROUTE_RULES_TEMPLATE_FILENAME,
+			getContents: () => getRouteRulesTemplate({
+				"/**": publicOptions,
+				...routeSecurityRules
+			})
+		});
+		addServerTemplate({
+			filename: ROUTE_RULES_PLUGIN_FILENAME,
+			getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/routeRules"), "createRouteRulesPlugin", ROUTE_RULES_TEMPLATE_FILENAME)
+		});
+		addNitroPlugin(ROUTE_RULES_PLUGIN_FILENAME);
+		if (options.removeLoggers) nuxt.options.vite = defu(getRemoveLoggersViteConfig(), nuxt.options.vite);
+		if (options.headers) nuxt.options.routeRules = defu({ "/**": { headers: getStaticResourceHeaders(options.headers) } }, nuxt.options.routeRules);
+		if (options.nonce) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/nonce"));
+		if (options.sri) {
+			addServerTemplate({
+				filename: SRI_PLUGIN_FILENAME,
+				getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/subresourceIntegrity"), "createSubresourceIntegrityPlugin", SRI_HASHES_TEMPLATE_FILENAME)
+			});
+			addNitroPlugin(SRI_PLUGIN_FILENAME);
+		}
+		if (options.ssg) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/ssgHashes"));
+		if (options.headers) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/securityHeaders"));
+		if (options.hidePoweredBy) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/hidePoweredBy"));
+		if (options.csrf) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/csrf"),
+			middleware: true
+		});
+		if (options.rateLimiter) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/rateLimiter"),
+			middleware: true
+		});
+		if (options.requestSizeLimiter) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/requestSizeLimiter"),
+			middleware: true
+		});
+		if (options.corsHandler) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/corsHandler"),
+			middleware: true
+		});
+		if (options.allowedMethodsRestricter) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/allowedMethodsRestricter"),
+			middleware: true
+		});
+		if (basicAuth) addServerHandler({
+			handler: resolver.resolve("./runtime/server/middleware/basicAuth"),
+			middleware: true
+		});
+		let sriHashes = {};
+		if (options.sri) {
+			addServerTemplate({
+				filename: SRI_HASHES_TEMPLATE_FILENAME,
+				getContents: () => `export default ${JSON.stringify(sriHashes)}\n`
+			});
+			nuxt.hook("nitro:build:public-assets", async (nitro) => {
+				sriHashes = await computeSubresourceIntegrityHashes(nitro);
+			});
+		}
+		addTypeTemplate({
+			filename: `types/${MODULE_NAME}.d.ts`,
+			getContents: getTypeTemplate
+		}, {
+			nitro: true,
+			nuxt: true
+		});
+	}
+});
+export { securityModule as default };

package/dist/models/AllowedMethodsRestricterOptions.d.ts

@@ -0,0 +1,3 @@
+export interface AllowedMethodsRestricterOptions {
+  methods: string[];
+}

package/dist/models/BasicAuthOptions.d.ts

@@ -0,0 +1,7 @@
+export interface BasicAuthOptions {
+  exclude?: string[];
+  include?: string[];
+  message?: string;
+  name: string;
+  pass: string;
+}

package/dist/models/ContentSecurityPolicy.d.ts

@@ -0,0 +1 @@
+export type ContentSecurityPolicy = Record<string, boolean | string[] | undefined>;

package/dist/models/CorsHandlerOptions.d.ts

@@ -0,0 +1,11 @@
+export interface CorsHandlerOptions {
+  allowHeaders?: string[];
+  credentials?: boolean;
+  exposeHeaders?: string[];
+  maxAge?: string;
+  methods: string[];
+  origin: string | string[];
+  preflight?: {
+    statusCode: number;
+  };
+}

package/dist/models/CrossOriginEmbedderPolicy.d.ts

@@ -0,0 +1,6 @@
+export declare const CrossOriginEmbedderPolicy: {
+  readonly Credentialless: "credentialless";
+  readonly RequireCorp: "require-corp";
+  readonly UnsafeNone: "unsafe-none";
+};
+export type CrossOriginEmbedderPolicy = (typeof CrossOriginEmbedderPolicy)[keyof typeof CrossOriginEmbedderPolicy];

package/dist/models/CrossOriginEmbedderPolicy.js

@@ -0,0 +1,7 @@
+// src/models/CrossOriginEmbedderPolicy.ts
+const CrossOriginEmbedderPolicy = {
+	Credentialless: "credentialless",
+	RequireCorp: "require-corp",
+	UnsafeNone: "unsafe-none"
+};
+export { CrossOriginEmbedderPolicy };

package/dist/models/CsrfOptions.d.ts

@@ -0,0 +1,4 @@
+export interface CsrfOptions {
+  cookieName: string;
+  headerName: string;
+}

package/dist/models/ModuleOptions.d.ts

@@ -0,0 +1,25 @@
+import { AllowedMethodsRestricterOptions } from "./AllowedMethodsRestricterOptions.js";
+import { BasicAuthOptions } from "./BasicAuthOptions.js";
+import { CorsHandlerOptions } from "./CorsHandlerOptions.js";
+import { CsrfOptions } from "./CsrfOptions.js";
+import { RateLimiterOptions } from "./RateLimiterOptions.js";
+import { RequestSizeLimiterOptions } from "./RequestSizeLimiterOptions.js";
+import { SecurityHeaders } from "./SecurityHeaders.js";
+import { SsgOptions } from "./SsgOptions.js";
+export interface ModuleOptions {
+  allowedMethodsRestricter: AllowedMethodsRestricterOptions | false;
+  basicAuth: BasicAuthOptions | false;
+  contentSecurityPolicyReportOnly: boolean;
+  corsHandler: CorsHandlerOptions | false;
+  csrf: CsrfOptions | false;
+  enabled: boolean;
+  headers: false | SecurityHeaders;
+  hidePoweredBy: boolean;
+  nonce: boolean;
+  rateLimiter: false | RateLimiterOptions;
+  removeLoggers: boolean;
+  requestSizeLimiter: false | RequestSizeLimiterOptions;
+  sri: boolean;
+  ssg: false | SsgOptions;
+  strict: boolean;
+}

package/dist/models/PermissionsPolicy.d.ts

@@ -0,0 +1 @@
+export type PermissionsPolicy = Record<string, false | string[] | undefined>;

package/dist/models/RateLimitWindow.d.ts

@@ -0,0 +1,4 @@
+export interface RateLimitWindow {
+  count: number;
+  resetAt: number;
+}

package/dist/models/RateLimiterOptions.d.ts

@@ -0,0 +1,4 @@
+export interface RateLimiterOptions {
+  intervalInMilliseconds: number;
+  tokensPerInterval: number;
+}

package/dist/models/RateLimiterStore.d.ts

@@ -0,0 +1,4 @@
+import { RateLimitWindow } from "./RateLimitWindow.js";
+export interface RateLimiterStore {
+  increment: (key: string, intervalInMilliseconds: number) => Promise<RateLimitWindow>;
+}

package/dist/models/RequestSizeLimiterOptions.d.ts

@@ -0,0 +1,3 @@
+export interface RequestSizeLimiterOptions {
+  maxRequestSizeInBytes: number;
+}

package/dist/models/SecurityHeaders.d.ts

@@ -0,0 +1,20 @@
+import { ContentSecurityPolicy } from "./ContentSecurityPolicy.js";
+import { CrossOriginEmbedderPolicy } from "./CrossOriginEmbedderPolicy.js";
+import { PermissionsPolicy } from "./PermissionsPolicy.js";
+import { StrictTransportSecurity } from "./StrictTransportSecurity.js";
+import { XFrameOptions } from "./XFrameOptions.js";
+export interface SecurityHeaders {
+  contentSecurityPolicy?: ContentSecurityPolicy | false;
+  crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicy | false;
+  crossOriginOpenerPolicy?: false | string;
+  crossOriginResourcePolicy?: false | string;
+  originAgentCluster?: false | string;
+  permissionsPolicy?: false | PermissionsPolicy;
+  referrerPolicy?: false | string;
+  strictTransportSecurity?: false | StrictTransportSecurity;
+  xContentTypeOptions?: false | string;
+  xDNSPrefetchControl?: false | string;
+  xDownloadOptions?: false | string;
+  xFrameOptions?: false | XFrameOptions;
+  xPermittedCrossDomainPolicies?: false | string;
+}

package/dist/models/SecurityRouteRules.d.ts

@@ -0,0 +1,2 @@
+import { ModuleOptions } from "./ModuleOptions.js";
+export type SecurityRouteRules = Partial<ModuleOptions>;

package/dist/models/SecurityRules.d.ts

@@ -0,0 +1,2 @@
+import { ModuleOptions } from "./ModuleOptions.js";
+export type SecurityRules = Partial<ModuleOptions>;

package/dist/models/SsgElement.d.ts

@@ -0,0 +1 @@
+export type SsgElement = [name: string, attributes: string, body: string | undefined];

package/dist/models/SsgHashSource.d.ts

@@ -0,0 +1,2 @@
+import { SecurityState } from "../runtime/services/getSecurityState.js";
+export type SsgHashSource = [kind: keyof SecurityState["hashes"], source: string];

package/dist/models/SsgOptions.d.ts

@@ -0,0 +1,5 @@
+export interface SsgOptions {
+  hashScripts: boolean;
+  hashStyles: boolean;
+  meta: boolean;
+}

package/dist/models/StrictTransportSecurity.d.ts

@@ -0,0 +1,5 @@
+export interface StrictTransportSecurity {
+  includeSubdomains: boolean;
+  maxAge: number;
+  preload: boolean;
+}

package/dist/models/XFrameOptions.d.ts

@@ -0,0 +1,5 @@
+export declare const XFrameOptions: {
+  readonly Deny: "DENY";
+  readonly SameOrigin: "SAMEORIGIN";
+};
+export type XFrameOptions = (typeof XFrameOptions)[keyof typeof XFrameOptions];

package/dist/models/XFrameOptions.js

@@ -0,0 +1,6 @@
+// src/models/XFrameOptions.ts
+const XFrameOptions = {
+	Deny: "DENY",
+	SameOrigin: "SAMEORIGIN"
+};
+export { XFrameOptions };

package/dist/runtime/constants.d.ts

@@ -0,0 +1,20 @@
+import { SecurityHeaders } from "../models/SecurityHeaders.js";
+export declare const MODULE_NAME = "nuxt-security-module";
+export declare const ROUTE_RULES_HOOK: `${typeof MODULE_NAME}:routeRules`;
+export declare const SECURITY_HEADER_NAMES: Readonly<Record<keyof SecurityHeaders, string>>;
+export declare const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
+export declare const MAX_RATE_LIMIT_ENTRIES = 1e4;
+export declare const UNKNOWN_CLIENT_KEY = "unknown";
+export declare const CSRF_UNSAFE_METHODS: readonly string[];
+export declare const CSRF_TOKEN_BYTE_LENGTH = 32;
+export declare const NONCE_BYTE_LENGTH = 18;
+export declare const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
+export declare const SRI_HASH_ALGORITHM = "SHA-384";
+export declare const CSP_HASH_ALGORITHM = "SHA-256";
+export declare const HTML_ATTRIBUTE_REGEX: RegExp;
+export declare const HTML_TAG_REGEX: RegExp;
+export declare const NONCE_TAG_NAMES: readonly string[];
+export declare const HTML_SECTIONS: readonly ["head", "bodyPrepend", "body", "bodyAppend"];
+export declare const SIZE_LIMITED_METHODS: readonly string[];
+export declare const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
+export declare const BASIC_AUTHORIZATION_SCHEME = "Basic";

package/dist/runtime/constants.js

@@ -0,0 +1,51 @@
+// src/runtime/constants.ts
+const MODULE_NAME = "nuxt-security-module";
+const ROUTE_RULES_HOOK = `${MODULE_NAME}:routeRules`;
+const SECURITY_HEADER_NAMES = {
+	contentSecurityPolicy: "Content-Security-Policy",
+	crossOriginEmbedderPolicy: "Cross-Origin-Embedder-Policy",
+	crossOriginOpenerPolicy: "Cross-Origin-Opener-Policy",
+	crossOriginResourcePolicy: "Cross-Origin-Resource-Policy",
+	originAgentCluster: "Origin-Agent-Cluster",
+	permissionsPolicy: "Permissions-Policy",
+	referrerPolicy: "Referrer-Policy",
+	strictTransportSecurity: "Strict-Transport-Security",
+	xContentTypeOptions: "X-Content-Type-Options",
+	xDNSPrefetchControl: "X-DNS-Prefetch-Control",
+	xDownloadOptions: "X-Download-Options",
+	xFrameOptions: "X-Frame-Options",
+	xPermittedCrossDomainPolicies: "X-Permitted-Cross-Domain-Policies"
+};
+const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
+const MAX_RATE_LIMIT_ENTRIES = 1e4;
+const UNKNOWN_CLIENT_KEY = "unknown";
+const STATE_CHANGING_METHODS = [
+	"DELETE",
+	"PATCH",
+	"POST",
+	"PUT"
+];
+const CSRF_UNSAFE_METHODS = STATE_CHANGING_METHODS;
+const CSRF_TOKEN_BYTE_LENGTH = 32;
+const NONCE_BYTE_LENGTH = 18;
+const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
+const SRI_HASH_ALGORITHM = "SHA-384";
+const CSP_HASH_ALGORITHM = "SHA-256";
+const HTML_ATTRIBUTE_PATTERN = String.raw`\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'<>=]+))?`;
+const HTML_ATTRIBUTE_REGEX = /\s+(?<name>[^\s"'<>/=]+)(?<assignment>\s*=\s*(?<value>"[^"]*"|'[^']*'|[^\s"'<>=]+))?/gu;
+const HTML_TAG_REGEX = new RegExp(String.raw`<(script|style)\b((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>([\s\S]*?)<\/\1\s*>|<([a-z][\w:-]*)((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>`, "giu");
+const NONCE_TAG_NAMES = [
+	"link",
+	"script",
+	"style"
+];
+const HTML_SECTIONS = [
+	"head",
+	"bodyPrepend",
+	"body",
+	"bodyAppend"
+];
+const SIZE_LIMITED_METHODS = STATE_CHANGING_METHODS;
+const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
+const BASIC_AUTHORIZATION_SCHEME = "Basic";
+export { BASIC_AUTHORIZATION_SCHEME, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, CSP_HASH_ALGORITHM, CSRF_TOKEN_BYTE_LENGTH, CSRF_UNSAFE_METHODS, DEFAULT_BASIC_AUTH_REALM, HTML_ATTRIBUTE_REGEX, HTML_SECTIONS, HTML_TAG_REGEX, MAX_RATE_LIMIT_ENTRIES, MODULE_NAME, NONCE_BYTE_LENGTH, NONCE_PLACEHOLDER, NONCE_TAG_NAMES, ROUTE_RULES_HOOK, SECURITY_HEADER_NAMES, SIZE_LIMITED_METHODS, SRI_HASH_ALGORITHM, UNKNOWN_CLIENT_KEY };

package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const hidePoweredBy: NitroAppPlugin;
+export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/hidePoweredBy.js

@@ -0,0 +1,12 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { definePlugin } from "nitro";
+import { isEvent } from "nitro/h3";
+// src/runtime/nitro/plugins/hidePoweredBy.ts
+const hidePoweredBy = definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("response", (response, event) => {
+		if (!isEvent(event)) return;
+		const rules = getSecurityRules(event);
+		if (rules?.enabled && rules.hidePoweredBy) response.headers.delete("x-powered-by");
+	});
+});
+export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/nonce.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const noncePlugin: NitroAppPlugin;
+export { noncePlugin as default };

package/dist/runtime/nitro/plugins/nonce.js

@@ -0,0 +1,21 @@
+import { HTML_SECTIONS } from "../../constants.js";
+import { generateNonce } from "../../services/generateNonce.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { injectNonce } from "../../services/injectNonce.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/nonce.ts
+const noncePlugin = definePlugin((nitroApp) => {
+	if (import.meta.prerender) return;
+	nitroApp.hooks.hook("render:route", (_context, { event }) => {
+		const rules = getSecurityRules(event);
+		if (rules?.enabled && rules.nonce) getSecurityState(event).nonce = generateNonce();
+	});
+	nitroApp.hooks.hook("render:html", (html, { event }) => {
+		const rules = getSecurityRules(event);
+		const nonce = getSecurityState(event).nonce;
+		if (!rules?.enabled || !rules.nonce || !rules.headers || !rules.headers.contentSecurityPolicy || !nonce) return;
+		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectNonce(element, nonce));
+	});
+});
+export { noncePlugin as default };

package/dist/runtime/nitro/plugins/routeRules.d.ts

@@ -0,0 +1,3 @@
+import { SecurityRules } from "../../../models/SecurityRules.js";
+import { NitroAppPlugin } from "nitro/types";
+export declare const createRouteRulesPlugin: (routeRules: Record<string, SecurityRules>) => NitroAppPlugin;

package/dist/runtime/nitro/plugins/routeRules.js

@@ -0,0 +1,20 @@
+import { ROUTE_RULES_HOOK } from "../../constants.js";
+import { setSecurityRouteMatcher, setSecurityRouteMatcherFailure } from "../../services/securityRouteMatcher.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/routeRules.ts
+const createRouteRulesPlugin = (routeRules) => definePlugin((nitroApp) => {
+	const resolveRouteRules = async () => {
+		const routes = structuredClone(routeRules);
+		await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
+		setSecurityRouteMatcher(routes);
+	};
+	let routesResolved;
+	nitroApp.hooks.hook("request", () => {
+		routesResolved ??= (async () => {
+			const [resolution] = await Promise.allSettled([resolveRouteRules()]);
+			if (resolution.status === "rejected") setSecurityRouteMatcherFailure(resolution.reason);
+		})();
+		return routesResolved;
+	});
+});
+export { createRouteRulesPlugin };

package/dist/runtime/nitro/plugins/securityHeaders.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const securityHeaders: NitroAppPlugin;
+export { securityHeaders as default };

package/dist/runtime/nitro/plugins/securityHeaders.js

@@ -0,0 +1,24 @@
+import { CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, SECURITY_HEADER_NAMES } from "../../constants.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { serializeSecurityHeaders } from "../../services/serializeSecurityHeaders.js";
+import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/securityHeaders.ts
+const CONTENT_SECURITY_POLICY_HEADER_NAME = SECURITY_HEADER_NAMES.contentSecurityPolicy;
+const securityHeaders = definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("render:route", (_context, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.headers) return;
+		const { contentSecurityPolicy } = rules.headers;
+		const serializedHeaders = serializeSecurityHeaders({
+			...rules.headers,
+			contentSecurityPolicy: contentSecurityPolicy ? updateContentSecurityPolicy(contentSecurityPolicy, getSecurityState(event)) : false
+		});
+		for (const [name, value] of Object.entries(serializedHeaders)) {
+			const isPolicy = name === CONTENT_SECURITY_POLICY_HEADER_NAME;
+			event.res.headers.set(isPolicy && rules.contentSecurityPolicyReportOnly ? CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME : name, value);
+		}
+	});
+});
+export { securityHeaders as default };

package/dist/runtime/nitro/plugins/ssgHashes.d.ts

@@ -0,0 +1,3 @@
+import { NitroAppPlugin } from "nitro/types";
+declare const ssgHashes: NitroAppPlugin;
+export { ssgHashes as default };

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -0,0 +1,21 @@
+import { HTML_SECTIONS } from "../../constants.js";
+import { collectSsgHashes } from "../../services/collectSsgHashes.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { insertContentSecurityPolicyMeta } from "../../services/insertContentSecurityPolicyMeta.js";
+import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/ssgHashes.ts
+const ssgHashes = definePlugin((nitroApp) => {
+	if (!import.meta.prerender) return;
+	nitroApp.hooks.hook("render:html", async (html, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
+		const state = getSecurityState(event);
+		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
+		if (!rules.ssg.meta || rules.contentSecurityPolicyReportOnly) return;
+		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
+		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
+	});
+});
+export { ssgHashes as default };

package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts

@@ -0,0 +1,2 @@
+import { NitroAppPlugin } from "nitro/types";
+export declare const createSubresourceIntegrityPlugin: (sriHashes: Record<string, string>) => NitroAppPlugin;

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -0,0 +1,13 @@
+import { HTML_SECTIONS } from "../../constants.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
+import { definePlugin } from "nitro";
+// src/runtime/nitro/plugins/subresourceIntegrity.ts
+const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("render:html", (html, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.sri) return;
+		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectSubresourceIntegrity(element, sriHashes));
+	});
+});
+export { createSubresourceIntegrityPlugin };

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const allowedMethodsRestricter: Middleware;
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -0,0 +1,14 @@
+import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+// src/runtime/server/middleware/allowedMethodsRestricter.ts
+const allowedMethodsRestricter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
+	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
+		status: 405,
+		statusText: "Method not allowed"
+	});
+});
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const basicAuthMiddleware: Middleware;
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/basicAuth.js

@@ -0,0 +1,22 @@
+import "../../constants.js";
+import { checkIsBasicAuthorized } from "../../services/checkIsBasicAuthorized.js";
+import { checkIsChallenged } from "../../services/checkIsChallenged.js";
+import { getBasicAuthOptions } from "../../services/getBasicAuthOptions.js";
+import { serializeBasicAuthChallenge } from "../../services/serializeBasicAuthChallenge.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+import { useRuntimeConfig } from "nuxt/server";
+// src/runtime/server/middleware/basicAuth.ts
+const basicAuthMiddleware = defineMiddleware((event) => {
+	const basicAuth = getBasicAuthOptions(useRuntimeConfig().private);
+	if (!basicAuth) return;
+	const { pathname } = event.url;
+	if (!checkIsChallenged(pathname, basicAuth)) return;
+	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
+	throw new HTTPError({
+		headers: { "WWW-Authenticate": serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password") },
+		status: 401,
+		statusText: "Access denied"
+	});
+});
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/corsHandler.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const corsHandler: Middleware;
+export { corsHandler as default };

package/dist/runtime/server/middleware/corsHandler.js

@@ -0,0 +1,20 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { handleCors } from "nitro/h3";
+// src/runtime/server/middleware/corsHandler.ts
+const corsHandler = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.corsHandler) return void 0;
+	const { allowHeaders, credentials, exposeHeaders, maxAge, methods, origin, preflight } = rules.corsHandler;
+	const response = handleCors(event, {
+		allowHeaders,
+		credentials,
+		exposeHeaders,
+		maxAge,
+		methods,
+		origin: [origin].flat(),
+		preflight
+	});
+	return response === false ? void 0 : response;
+});
+export { corsHandler as default };

package/dist/runtime/server/middleware/csrf.d.ts

@@ -0,0 +1,3 @@
+import { Middleware } from "nitro/h3";
+declare const csrf: Middleware;
+export { csrf as default };