Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-31 11:05:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

refactor: invert helmet configuration

Browse Source
This commit is contained in:
Julian Lam
2022-07-19 09:54:44 -04:00
parent b2da02d676
commit dcacd815a9
1 changed files with 13 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/webserver.js
View File

@@ -187,34 +187,26 @@ function setupExpressApp(app) {
} }
function setupHelmet(app) { function setupHelmet(app) {
/** const options = {
* The only reason why these middlewares are all explicitly spelled out is because contentSecurityPolicy: false, // defaults are too restrive and break plugins that load external assets... 🔜
* helmet.contentSecurityPolicy() is too restrictive and breaks plugins. crossOriginOpenerPolicy: { policy: meta.config['cross-origin-opener-policy'] },
* crossOriginResourcePolicy: { policy: meta.config['cross-origin-resource-policy'] },
* It should be implemented in the future... 🔜 referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
*/ };
if (meta.config['cross-origin-embedder-policy']) { if (meta.config['cross-origin-embedder-policy']) {
app.use(helmet.crossOriginEmbedderPolicy()); options.crossOriginEmbedderPolicy = false;
} }
app.use(helmet.crossOriginOpenerPolicy({ policy: meta.config['cross-origin-opener-policy'] }));
app.use(helmet.crossOriginResourcePolicy({ policy: meta.config['cross-origin-resource-policy'] }));
app.use(helmet.dnsPrefetchControl());
app.use(helmet.expectCt());
app.use(helmet.frameguard());
app.use(helmet.hidePoweredBy());
if (meta.config['hsts-enabled']) { if (meta.config['hsts-enabled']) {
app.use(helmet.hsts({ options.hsts = {
maxAge: meta.config['hsts-maxage'], maxAge: meta.config['hsts-maxage'],
includeSubDomains: !!meta.config['hsts-subdomains'], includeSubDomains: !!meta.config['hsts-subdomains'],
preload: !!meta.config['hsts-preload'], preload: !!meta.config['hsts-preload'],
})); };
} }
app.use(helmet.ieNoOpen());
app.use(helmet.noSniff()); app.use(helmet(options));
app.use(helmet.originAgentCluster());
app.use(helmet.permittedCrossDomainPolicies());
app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));
app.use(helmet.xssFilter());
} }