All files / server/plugins/security index.js

100% Statements 8/8
100% Branches 8/8
100% Functions 3/3
100% Lines 8/8
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 6432x 32x   32x                                                                                           125x         125x 102x 102x       125x      
const csurf = require('csurf');
const helmet = require('helmet');
 
module.exports = {
  name: 'security',
  options: {
    csrf: {
      env: 'SECURITY_CSRF',
      default: {},
      type: Object
    },
    contentSecurityPolicy: {
      env: 'SECURITY_CONTENTSECURITYPOLICY'
    },
    expectCt: {
      env: 'SECURITY_EXPECTCT'
    },
    dnsPrefetchControl: {
      env: 'SECURITY_DNSPREFETCHCONTROL'
    },
    frameguard: {
      env: 'SECURITY_FRAMEGUARD'
    },
    hidePoweredBy: {
      env: 'SECURITY_HIDEPOWEREDBY'
    },
    hpkp: {
      env: 'SECURITY_HPKP'
    },
    hsts: {
      env: 'SECURITY_HSTS'
    },
    ieNoOpen: {
      env: 'SECURITY_IENOOPEN'
    },
    noCache: {
      env: 'SECURITY_NOCACHE'
    },
    noSniff: {
      env: 'SECURITY_NOSNIFF'
    },
    referrerPolicy: {
      env: 'SECURITY_REFERRERPOLICY'
    },
    xssFilter: {
      env: 'SECURITY_XSSFILTER'
    }
  },
  before: [
    ctx => ctx.options.security && ctx.options.security.csrf
      ? ctx.utils.modern(csurf(ctx.options.security.csrf))(ctx)
      : false,
    ctx => {
      // Set the csrf for render(): https://expressjs.com/en/api.html#res.locals
      if (ctx.req && ctx.req.csrfToken) {
        ctx.csrf = ctx.req.csrfToken();
        ctx.res.locals.csrf = ctx.csrf;
      }
    },
    // The whole plugin will be deactivated if the security is false
    ctx => ctx.utils.modern(helmet(ctx.options.security))(ctx)
  ]
};