webspresso 0.0.1 → 0.0.2

package/README.md

@@ -180,6 +180,15 @@ Creates and configures the Express app.
 - `viewsDir` (optional): Path to views/layouts directory
 - `publicDir` (optional): Path to public/static directory
 - `logging` (optional): Enable request logging (default: true in development)
+- `helmet` (optional): Helmet security configuration
+  - `true` or `undefined`: Use default secure configuration
+  - `false`: Disable Helmet
+  - `Object`: Custom Helmet configuration (merged with defaults)
+
+**Default Helmet Configuration:**
+- CSP disabled in development, enabled in production
+- HSTS, XSS protection, frame guard, and other security headers enabled
+- Tailwind CSS inline styles allowed in CSP
 
 **Returns:** `{ app, nunjucksEnv }`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "bin": {
@@ -34,6 +34,7 @@
   "dependencies": {
     "commander": "^11.1.0",
     "express": "^4.18.2",
+    "helmet": "^7.2.0",
     "inquirer": "^8.2.6",
     "nunjucks": "^3.2.4"
   },

package/src/server.js

@@ -4,10 +4,53 @@
  */
 
 const express = require('express');
+const helmet = require('helmet');
 const nunjucks = require('nunjucks');
-const path = require('path');
+
 const { mountPages } = require('./file-router');
 
+/**
+ * Get default Helmet configuration
+ * @param {boolean} isDev - Whether in development mode
+ * @returns {Object} Helmet configuration
+ */
+function getDefaultHelmetConfig(isDev) {
+  return {
+    // Disable CSP in development for easier development (Nunjucks hot reload, etc.)
+    contentSecurityPolicy: isDev ? false : {
+      directives: {
+        defaultSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"], // Allow inline styles for Tailwind
+        scriptSrc: ["'self'"],
+        imgSrc: ["'self'", "data:", "https:"],
+        fontSrc: ["'self'", "data:"],
+        connectSrc: ["'self'"],
+        frameSrc: ["'none'"],
+        objectSrc: ["'none'"],
+        upgradeInsecureRequests: []
+      }
+    },
+    // Other security headers
+    crossOriginEmbedderPolicy: false, // Disable for better compatibility
+    crossOriginOpenerPolicy: { policy: 'same-origin' },
+    crossOriginResourcePolicy: { policy: 'cross-origin' },
+    dnsPrefetchControl: true,
+    frameguard: { action: 'deny' },
+    hidePoweredBy: true,
+    hsts: {
+      maxAge: 31536000,
+      includeSubDomains: true,
+      preload: true
+    },
+    ieNoOpen: true,
+    noSniff: true,
+    originAgentCluster: true,
+    permittedCrossDomainPolicies: false,
+    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+    xssFilter: true
+  };
+}
+
 /**
  * Create and configure the Express app
  * @param {Object} options - Configuration options
@@ -15,6 +58,7 @@ const { mountPages } = require('./file-router');
  * @param {string} options.viewsDir - Path to views directory  
  * @param {string} options.publicDir - Path to public/static directory
  * @param {boolean} options.logging - Enable request logging (default: isDev)
+ * @param {Object|boolean} options.helmet - Helmet configuration (default: auto-configured, false to disable)
  * @returns {Object} { app, nunjucksEnv }
  */
 function createApp(options = {}) {
@@ -26,7 +70,8 @@ function createApp(options = {}) {
     pagesDir,
     viewsDir,
     publicDir,
-    logging = isDev && !isTest
+    logging = isDev && !isTest,
+    helmet: helmetConfig
   } = options;
   
   if (!pagesDir) {
@@ -35,6 +80,16 @@ function createApp(options = {}) {
   
   const app = express();
   
+  // Security headers with Helmet
+  if (helmetConfig !== false) {
+    const defaultConfig = getDefaultHelmetConfig(isDev);
+    const finalConfig = helmetConfig === undefined || helmetConfig === true
+      ? defaultConfig
+      : { ...defaultConfig, ...helmetConfig };
+    
+    app.use(helmet(finalConfig));
+  }
+  
   // Trust proxy (for correct req.ip, req.protocol behind reverse proxy)
   app.set('trust proxy', 1);