pixl-server-web 2.0.13 → 2.0.14

package/README.md

@@ -21,6 +21,7 @@ This module is a component for use in [pixl-server](https://www.github.com/jhuck
 	* [http_regex_json](#http_regex_json)
 	* [http_response_headers](#http_response_headers)
 	* [http_code_response_headers](#http_code_response_headers)
+	* [http_uri_response_headers](#http_uri_response_headers)
 	* [http_timeout](#http_timeout)
 	* [http_request_timeout](#http_request_timeout)
 	* [http_keep_alives](#http_keep_alives)
@@ -251,7 +252,7 @@ This is a regular expression string used to determine if the incoming POST reque
 
 ## http_response_headers
 
-This param allows you to send back any additional custom HTTP headers with each response.  Set the param to an object containing keys for each header, like this:
+This param allows you to send back additional custom HTTP headers with *every* response.  Set the param to an object containing keys for each header, like this:
 
 ```json
 {
@@ -290,6 +291,36 @@ An actual useful case would be to include a [Retry-After](https://developer.mozi
 
 This would give a hint to clients when they receive a `429` (Too Many Requests) response from the web server, that they should wait `10` seconds before trying again.
 
+## http_uri_response_headers
+
+This property allows you to include *conditional* response headers, based on regular expression matches on incoming request URIs.  You may specify multiple patterns, and multiple headers to inject for each URI match.  For example, you can instruct the web server to send back custom headers for a specific URI prefix, like this:
+
+```json
+{
+	"http_uri_response_headers": {
+		"^/secret": {
+			"X-Message": "You found the secret area!",
+			"X-Foo": "Bar"
+		}
+	}
+}
+```
+
+An actual useful case would be to include a set of [CSP headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) for all HTML files, and URIs that end in a slash (which typically present an HTML file).  Example:
+
+```json
+{
+	"http_uri_response_headers": {
+		"(\/|\\.html)$": {
+			"Content-Security-Policy": "default-src 'none'; script-src 'self'; script-src-elem 'self'; script-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; manifest-src 'self';img-src 'self' data: blob:; font-src 'self'; connect-src 'self' ws: wss:; media-src 'self' blob:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none';",
+			"X-Content-Type-Options": "nosniff",
+			"Referrer-Policy": "strict-origin-when-cross-origin",
+			"Permissions-Policy": "camera=(), microphone=(), geolocation=(), fullscreen=()"
+		}
+	}
+}
+```
+
 ## http_timeout
 
 This sets the idle socket timeout for all incoming HTTP requests, in seconds.  If omitted, the Node.js default is 120 seconds.  Example:

package/lib/response.js

@@ -82,11 +82,25 @@ module.exports = class Response {
 		// merge in conditional headers based on response code
 		var code_headers = this.config.get('http_code_response_headers');
 		if (code_headers && (http_code in code_headers)) {
+			this.logDebug(9, "Injecting custom response headers for HTTP code: " + http_code, code_headers[http_code]);
 			for (var key in code_headers[http_code]) {
 				headers[key] = code_headers[http_code][key];
 			}
 		}
 		
+		// merge in conditional headers based on URI
+		var uri = request.url;
+		if (!this.config.get('http_full_uri_match')) uri = uri.replace(/\?.*$/, '');
+		
+		this.uriResponseHeaders.forEach( function(item) {
+			if (!uri.match(item.regexp)) return;
+			self.logDebug(9, "Injecting custom response headers for URI match: " + item.regexp, item.headers);
+			
+			for (var key in item.headers) {
+				headers[key] = item.headers[key];
+			}
+		} );
+		
 		// use duck typing to see if we have a stream, buffer or string
 		var is_stream = (body && body.pipe);
 		var is_buffer = (body && body.fill);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pixl-server-web",
-	"version": "2.0.13",
+	"version": "2.0.14",
 	"description": "A web server component for the pixl-server framework.",
 	"author": "Joseph Huckaby <jhuckaby@gmail.com>",
 	"homepage": "https://github.com/jhuckaby/pixl-server-web",

package/web_server.js

@@ -267,6 +267,19 @@ class WebServer extends Component {
 			this.logDebug(5, "Setting bind address to localhost for debug mode");
 			this.config.set('http_bind_address', 'localhost');
 		}
+		
+		// pre-compile regexps for http_uri_response_headers
+		this.uriResponseHeaders = [];
+		var patterns = this.config.get('http_uri_response_headers');
+		if (patterns) {
+			for (var pat in patterns) {
+				this.logDebug(5, "Adding custom response headers for URI pattern: " + pat, patterns[pat]);
+				this.uriResponseHeaders.push({
+					regexp: new RegExp(pat),
+					headers: patterns[pat]
+				});
+			}
+		}
 	}
 	
 	postStartupMessage() {