tezx/middleware/xss-protection.js

TezX is a modern, ultra-lightweight, and high-performance JavaScript framework built specifically for Bun. It provides a minimal yet powerful API, seamless environment management, and a high-concurrency HTTP engine for building fast, scalable web applicat

const xssProtection = (options = {}) => {
    const { enabled = true, mode = "block", fallbackCSP = "default-src 'self'; script-src 'self';", } = options;
    return async function xssProtection(ctx, next) {
        const isEnabled = typeof enabled === "function" ? enabled(ctx) : enabled;
        if (!isEnabled) {
            return await next();
        }
        const xssHeaderValue = mode === "block" ? "1; mode=block" : "1";
        ctx.setHeader("X-XSS-Protection", xssHeaderValue);
        if (fallbackCSP) {
            const existingCSP = ctx.req.header("content-security-policy");
            if (!existingCSP) {
                ctx.setHeader("Content-Security-Policy", fallbackCSP);
            }
        }
        return await next();
    };
};
export { xssProtection as default, xssProtection };