veloze

/** * @typedef {object} CspMiddlewareOptions * @property {string[]} [extensions=['', '.html', '.htm']] extensions where CSP is applied * @property {CspOptions|false} [csp] content-security-policy; false disables CSP * @property {HstsOptions|false} [hsts] strict-transport-security; false disables HSTS * @property {ReferrerPolicy|false} [referrerPolicy='no-referrer'] referrer-policy header * @property {boolean} [xContentTypeOptions=true] x-content-type-options header; true sets 'nosniff' * @property {'on'|'off'|false} [xDnsPrefetchControl='off'] x-dns-prefetch-control header * @property {'require-corp'|'unsafe-none'|'credentialless'|false} [crossOriginEmbedderPolicy='require-corp'] cross-origin-embedder-policy header; see https://web.dev/coop-coep/ * @property {'same-origin'|'same-origin-allow-popups'|'unsafe-none'|false} [crossOriginOpenerPolicy='same-origin'] cross-origin-opener-policy header * @property {'same-origin'|'same-site'|'cross-origin'|false} [crossOriginResourcePolicy='same-origin'] cross-origin-resource-policy header */ /** * Middleware which adding various security headers to html page responses. * * This is a "slow" middleware. If performance is required it is recommended to * set the security headers "manually". Use this middleware then to identify the * necessary secure settings to extract the headers into it's own middleware. * * - csp: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy * - hsts: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security * - referrerPolicy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy * - xContentTypeOptions: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options * - xDnsPrefetchControl: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control * - crossOriginEmbedderPolicy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy * - crossOriginOpenerPolicy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy * - crossOriginResourcePolicy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy * * Links * * - https://web.dev/strict-csp/ * - https://owasp.org/www-project-secure-headers/ci/headers_add.json * * @param {CspMiddlewareOptions} [options] * @returns {HandlerCb} */ export function contentSec(options?: CspMiddlewareOptions): HandlerCb; /** * Middleware adding various security headers to json responses. * @see https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#security-headers * @param {CspMiddlewareOptions} [options] * @returns {HandlerCb} */ export function contentSecJson(options?: CspMiddlewareOptions): HandlerCb; /** * Parse and log csp violation * @returns {HandlerCb} */ export function cspReport(): HandlerCb; export function buildHsts(options: HstsOptions | boolean | undefined): string | undefined; export function buildCsp(options?: CspOptions | {}): string; export type CspMiddlewareOptions = { /** * extensions where CSP is applied */ extensions?: string[] | undefined; /** * content-security-policy; false disables CSP */ csp?: false | CspOptions | undefined; /** * strict-transport-security; false disables HSTS */ hsts?: false | HstsOptions | undefined; /** * referrer-policy header */ referrerPolicy?: false | ReferrerPolicy | undefined; /** * x-content-type-options header; true sets 'nosniff' */ xContentTypeOptions?: boolean | undefined; /** * x-dns-prefetch-control header */ xDnsPrefetchControl?: false | "on" | "off" | undefined; /** * cross-origin-embedder-policy header; see https://web.dev/coop-coep/ */ crossOriginEmbedderPolicy?: false | "require-corp" | "unsafe-none" | "credentialless" | undefined; /** * cross-origin-opener-policy header */ crossOriginOpenerPolicy?: false | "same-origin" | "unsafe-none" | "same-origin-allow-popups" | undefined; /** * cross-origin-resource-policy header */ crossOriginResourcePolicy?: false | "same-origin" | "same-site" | "cross-origin" | undefined; }; export type HandlerCb = typeof import("../types.js").HandlerCb; export type Log = import("../types.js").Log; export type HstsOptions = { /** * max-age in seconds (defaults to 180days) or ms string */ maxAge?: string | number | undefined; includeSubDomains?: boolean | undefined; preload?: boolean | undefined; }; export type ReferrerPolicy = "no-referrer" | "no-referrer-when-downgrade" | "origin" | "origin-when-cross-origin" | "same-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url"; export type CspOptions = { /** * if `true` CspOptions are not patched with CSP_DEFAULTS */ omitDefaults?: boolean | undefined; /** * if `true` csp is only reported but not blocked */ reportOnly?: boolean | undefined; "connect-src"?: string | string[] | undefined; "default-src"?: string | string[] | undefined; "font-src"?: string | string[] | undefined; "frame-src"?: string | string[] | undefined; "img-src"?: string | string[] | undefined; "manifest-src"?: string | string[] | undefined; "media-src"?: string | string[] | undefined; "object-src"?: string | string[] | undefined; "prefetch-src"?: string | string[] | undefined; "script-src"?: string | string[] | undefined; "script-src-elem"?: string | string[] | undefined; "script-src-attr"?: string | string[] | undefined; "style-src"?: string | string[] | undefined; "style-src-elem"?: string | string[] | undefined; "style-src-attr"?: string | string[] | undefined; "worker-src"?: string | string[] | undefined; "base-uri"?: string | string[] | undefined; sandbox?: string | string[] | undefined; "form-action"?: string | string[] | undefined; "frame-ancestors"?: string | string[] | undefined; "navigate-to"?: string | string[] | undefined; "report-to"?: string | undefined; "report-uri"?: string | undefined; "require-trusted-types-for"?: string | string[] | undefined; "trusted-types"?: string | string[] | undefined; "upgrade-insecure-requests"?: boolean | undefined; };