{"_id":"node-guard","_rev":"3-9df7b1a81e2ff4e42d944340720f16dc","name":"node-guard","description":"General purpose I/O module to add following http headers to keep your webpages securing them from malware attacks. This module can be used with any node http server.","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"node-guard","version":"1.0.0","description":"General purpose I/O module to add following http headers to keep your webpages securing them from malware attacks. This module can be used with any node http server.","main":"index.js","directories":{"test":"test"},"scripts":{"test":"npm run standard && istanbul cover _mocha --report lcovonly -- -R spec test && cat ./coverage/lcov.info | coveralls && rm -rf ./coverage","coverage":"istanbul cover _mocha test --bail","standard":"standard src/**/*.js"},"author":{"name":"amanvirk"},"license":"MIT","devDependencies":{"chai":"^3.4.1","co-mocha":"^1.1.2","coveralls":"^2.11.6","istanbul":"^0.4.1","mocha":"^2.3.4","mocha-lcov-reporter":"^1.0.0","standard":"^5.4.1","supertest":"^1.1.0"},"dependencies":{},"repository":{"type":"git","url":"git+https://github.com/poppinss/node-guard.git"},"keywords":["xss","frameguard","nosniff","noopen"],"bugs":{"url":"https://github.com/poppinss/node-guard/issues"},"homepage":"https://github.com/poppinss/node-guard#readme","gitHead":"d568393e86bbe700d5e49517edb3a2e227f8c50d","_id":"node-guard@1.0.0","_shasum":"e4549beb791c3b1c842755a5273b73be8b080a34","_from":".","_npmVersion":"3.3.5","_nodeVersion":"4.1.0","_npmUser":{"name":"amanvirk","email":"virk.officials@gmail.com"},"dist":{"shasum":"e4549beb791c3b1c842755a5273b73be8b080a34","tarball":"https://registry.npmjs.org/node-guard/-/node-guard-1.0.0.tgz","integrity":"sha512-LX911hOl63/YBO3Skl/jQ9QQG+lE++66xaF9/lg7G02bBpdgHMmSdMK5+jgo7p/3i5hn4fGOipX3Ko17Yzfi2w==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCICyItPy3RnZ4gfrEHjcMTWINzZJAqXwC5DtOzpp6bPKLAiEA/ZaB+dR0IfjIcGTBNWb0dMXTZuvfjso0p5xLJJWQpLk="}]},"maintainers":[{"name":"amanvirk","email":"virk.officials@gmail.com"}]}},"readme":"## Node Guard\n\n![](http://i1117.photobucket.com/albums/k594/thetutlage/poppins-1_zpsg867sqyl.png)\n\n![](https://img.shields.io/travis/poppinss/node-guard.svg?style=flat-square)\n[![Coverage Status](https://img.shields.io/coveralls/poppinss/node-guard/master.svg?style=flat-square)](https://coveralls.io/github/poppinss/node-guard?branch=master)\n[![License](https://img.shields.io/npm/l/node-guard.svg?style=flat-square)](https://opensource.org/licenses/MIT)\n\n\nGeneral purpose I/O module to add following http headers to keep your webpages securing them from malware attacks. This module can be used with any node http server.\n\n- [X-XSS-Protection](#x-xss-protection)\n- [X-Frame-Options](#x-frame-options)\n- [X-Content-Type-Options](#x-content-type-options)\n- [X-Download-Options](#x-download-options)\n\n## X-XSS-Protection\n\n`X-XSS-Protection` http header saves you from `XSS` attacks. `node-guard` will set up `X-XSS-Protection` header on all modern browsers and will disable it for older versions of IE as they have security vulnerabilities defined here https://technet.microsoft.com/library/security/ms10-002.\n\n```javascript\nconst http = require('http')\nconst guard = require('node-guard')\nconst options = {\n  enabled: true,\n  enableOnOldIE: false\n}\n\nhttp.createServer(function (req, res) {\n  guard.addXssFilter(req, res, options)\n  res.end()\n}).listen(3000)\n```\n\n## X-Frame-Options\n\n`X-Frame-Options` defines whether your webpage can be embedded as an iframe to other website. It can take 3 different values from `ALLOW-FROM`, `DENY` and `SAMEORIGIN`\n\n```javascript\nconst http = require('http')\nconst guard = require('node-guard')\nconst options = 'DENY' // cannot be embedded at all\n// or\nconst options = 'SAMEORIGIN' // only this website\n// or\nconst options = 'ALLOW-FROM http://example.com' // defined uri\n\nhttp.createServer(function (req, res) {\n  guard.addFrameOptions(res, options)\n  res.end()\n}).listen(3000)\n```\n\n## X-Content-Type-Options\n\n`X-Content-Type-Options` disables sniffing from web browsers, where they will try to `sniff` mimetypes. Which means a web browser will execute the javascript file even if the `content-type` of that file is not set to `javascript`. Give it a read https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/\n\n\n```javascript\nconst http = require('http')\nconst guard = require('node-guard')\nconst options = true // or false\n\nhttp.createServer(function (req, res) {\n  guard.addNoSniff(res, options)\n  res.end()\n}).listen(3000)\n```\n\n## X-Download-Options\n\nIE specific header to stop users from executing html files with the access to your site context. Here is a good read on same https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/.\n\n```javascript\nconst http = require('http')\nconst guard = require('node-guard')\nconst options = true // or false\n\nhttp.createServer(function (req, res) {\n  guard.addNoOpen(res, options)\n  res.end()\n}).listen(3000)\n```","maintainers":[{"name":"amanvirk","email":"virk.officials@gmail.com"}],"time":{"modified":"2022-06-21T15:21:15.193Z","created":"2016-01-10T16:10:43.737Z","1.0.0":"2016-01-10T16:10:43.737Z"},"homepage":"https://github.com/poppinss/node-guard#readme","keywords":["xss","frameguard","nosniff","noopen"],"repository":{"type":"git","url":"git+https://github.com/poppinss/node-guard.git"},"author":{"name":"amanvirk"},"bugs":{"url":"https://github.com/poppinss/node-guard/issues"},"license":"MIT","readmeFilename":"readme.md"}