Secure headers

npm i @inkanjs/secure-headers

import { secureHeaders } from "@inkanjs/secure-headers";

app
  .register(secureHeaders())
  .get("/", (ctx) => html`<script nonce="${ctx.cspNonce}">start()</script>`);

What helmet does for Express. Every header can be changed or left out, and a header the handler set itself is never overwritten.

What every answer getsCopy Anchor Link

A string sends another value, false leaves the header out. extra adds headers of your own the same way.

The default policy, exported as DEFAULT_CSP:

default-src 'self'; base-uri 'self'; font-src 'self' https: data:; form-action 'self';
frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self';
script-src-attr 'none'; style-src 'self'

No 'unsafe-inline' anywhere: inline scripts and styles need a nonce.

secureHeaders({
  csp: {
    directives: { "img-src": ["'self'", "https://cdn.example.com"], "script-src-attr": false, "upgrade-insecure-requests": true },
    // useDefaults: false   start from nothing
    // reportOnly: true     content-security-policy-report-only
  },
  hsts: { maxAge: 63072000, preload: true },
  crossOriginResourcePolicy: "cross-origin", // a public API that pages on other sites load
});

BehaviourCopy Anchor Link

• The nonce. ctx.cspNonce is 128 random bits, fresh for every request, made only when read. An answer whose handler (or template) read it gets 'nonce-…' in script-src and style-src; every other answer gets the plain policy.
• HSTS goes out only over HTTPS: the socket is a TLS socket, or https(ctx) says so. Behind a proxy that ends TLS, pass https: (ctx) => ctx.headers["x-forwarded-proto"] === "https" (only when the proxy sets that header itself) or hsts: { force: true }.
• Your headers win. A header the handler or an earlier hook set stays as it is, so one route can send its own policy.
• inkan's own pages keep working. /docs, /openapi.json and the inspector are answered before any hook runs, so they never get these headers.
• Problems (4xx, 5xx) get the headers too, and so do streams.

OptionsCopy Anchor Link

OpenAPICopy Anchor Link

Unchanged. It is a shared plugin: registered on the app it serves every route, inside a plugin only that plugin's routes.