@side/fortifyjs
    TypeScript icon, indicating that this package has built-in type declarations

    1.1.2 • Public • Published

    @side/fortifyjs

    A platform-agnostic library for generating security headers for your web application.

    NPM version License Build Status Coverage Status semantic-release Code Style

    Getting Started

    Modern web applications don't just need a helmet; they need a fortress. FortifyJS is just that, the walls to gate client and server-side requests in a world where attackers can manipulate the browser in many ways to break into your web application and steal information of trade secrets.

    While helmet.js is useful for express applications, in a world of alternatives to express popping up and different ways of writing JavaScript applications on the rise, there needs to be an alternative that abstracts the production of valid security headers out of our modern applications. FortifyJS exists in this niche. FortifyJS is solely responsible for providing a representation that is useful in setting headers in consumer applications. FortifyJS takes control of the headers; you take over and implement them in your application.

    FortifyJS also differs in that it seeks to provide a comprehensive set of security headers to form a default posture for any application.

    Installation

    Install through your package manager within an existing project:

    yarn add @side/fortifyjs

    How-to

    FortifyJS exports one function: fortifyHeaders. FortifyJS takes an object literal with properties that match each supported security header. This function returns an object mapping ths string header name (e.g. X-Content-Type-Options) to a value (e.g. nosniff).

    The current default configuration can be expressed like this:

    import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';
    
    const headers = fortifyHeaders({
      xContentTypeOptions: {
        nosniff: true,
      },
      contentSecurityPolicy: {
        defaultSrc: ["'self'"],
        baseUri: ["'self'"],
        fontSrc: ["'self'", 'https:', 'data:'],
        frameAncestors: ["'self'"],
        imgSrc: ["'self'", "'data:'"],
        objectSrc: ["'none'"],
        scriptSrc: ["'self'"],
        scriptSrcAttr: ["'none'"],
        styleSrc: ["'self'", "'https:'", "'unsafe-inline'"],
        upgradeInsecureRequests: true,
      },
      crossOriginEmbedderPolicy: {
        requireCorp: true,
      },
      crossOriginOpenerPolicy: {
        sameOrigin: true,
      },
      crossOriginResourcePolicy: {
        sameOrigin: true,
      },
      expectCt: {
        maxAge: 0,
      },
      originAgentCluster: {
        enable: true,
      },
      referrerPolicy: {
        noReferrer: true,
      },
      strictTransportSecurity: {
        maxAge: 15552000,
      },
      xContentTypeOptions: {
        noSniff: true,
      },
      xDnsPrefetchControl: {
        off: true,
      },
      xDownloadOptions: {
        noopen: true,
      },
      xFrameOptions: {
        sameOrigin: true,
      },
      xPermittedCrossDomainPolicies: {
        none: true,
      },
    });
    
    /** @type {FortifySettings} */
    console.log(headers);
    /*
     * {
          'Content-Security-Policy':
            "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests",
          'Cross-Origin-Embedder-Policy': 'require-corp',
          'Cross-Origin-Opener-Policy': 'same-origin',
          'Cross-Origin-Resource-Policy': 'same-origin',
          'Expect-Ct': 'max-age=0',
          'Origin-Agent-Cluster': '?1',
          'Referrer-Policy': 'no-referrer',
          'Strict-Transport-Security': 'max-age=15552000',
          'X-Content-Type-Options': 'nosniff',
          'X-Dns-Prefetch-Control': 'off',
          'X-Download-Options': 'noopen',
          'X-Frame-Options': 'SAMEORIGIN',
          'X-Permitted-Cross-Domain-Policies': 'none',
        }
     */

    You can choose to use these defaults by setting the fortify header to an empty object. This can be done globally:

    import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';
    
    const headers = fortifyHeaders();
    
    /** @type {FortifySettings} */
    console.log(headers); // same as above

    Or, you can choose to pull in individual header default postures:

    import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';
    
    const headers = fortifyHeaders({
      contentSecurityPolicy: {},
    });
    
    /** @type {FortifySettings} */
    console.log(headers); // same as above
    /*
     * {
          'Content-Security-Policy':
            "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests",
        }
     */

    If you want to specify a custom header value for one, like Content-Security-Policy, but also want to include all of the default headers, then you can use the second parameter to fortifyHeaders to tell the header generation that you want to include the rest of the available headers:

    import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';
    
    const headers = fortifyHeaders(
      {
        contentSecurityPolicy: {
          defaultSrc: ["'self'", '*.somedomain.com'],
        },
      },
      { useDefaults: true },
    );
    
    /** @type {FortifySettings} */
    console.log(headers); // same as above
    /*
     * {
          'Content-Security-Policy': "default-src 'self' *.somedomain.com",
          'Cross-Origin-Embedder-Policy': 'require-corp',
          'Cross-Origin-Opener-Policy': 'same-origin',
          'Cross-Origin-Resource-Policy': 'same-origin',
          'Expect-Ct': 'max-age=0',
          'Origin-Agent-Cluster': '?1',
          'Referrer-Policy': 'no-referrer',
          'Strict-Transport-Security': 'max-age=15552000',
          'X-Content-Type-Options': 'nosniff',
          'X-Dns-Prefetch-Control': 'off',
          'X-Download-Options': 'noopen',
          'X-Frame-Options': 'SAMEORIGIN',
          'X-Permitted-Cross-Domain-Policies': 'none',
        }
     */

    You can then use this object to integrate within the platform of your choice: next, fastify, etc.

    Header Inclusion Strategy

    The strategy for this problem is building a lib that can be consumed by packages that integrate with these different providers: next, fastify, etc.

    Since this library is specifically for delivering the relevant headers to secure modern web applications, it not contain information about X-Powered-By. This header is typically removed completely. FortifyJS only provides ones that ought to be included, not excluded. This should be handled at the consumer-level in whichever platform you're integrating the security headers into.

    Supported Headers

    Header Name Default Value Details
    Content-Security-Policy default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests Link
    Cross-Origin-Embedder-Policy require-corp Link
    Cross-Origin-Opener-Policy same-origin Link
    Cross-Origin-Resource-Policy same-origin Link
    Expect-Ct max-age=0 Link
    Origin-Agent-Cluster ?1 Link
    Referrer-Policy no-referrer Link
    Strict-Transport-Security max-age=15552000 Link
    X-Content-Type-Options nosniff Link
    X-Dns-Prefetch-Control off Link
    X-Download-Options noopen Link
    X-Frame-Options SAMEORIGIN Link
    X-Permitted-Cross-Domain-Policies none Link

    Contributing Policy

    The development team at Side is currently investigating the best expression of Codes of Conduct and Contributing Guidelines to fit our culture and values. FortifyJS is a Free and Open Source software solution that is licensed under MIT. If you desire to contribute to extend the functionality or address an issue, please maintain professional communication practices. That alone goes a long way toward effective collaboration and benefiting the community at large!

    Keywords

    none

    Install

    npm i @side/fortifyjs

    DownloadsWeekly Downloads

    3,047

    Version

    1.1.2

    License

    MIT

    Unpacked Size

    145 kB

    Total Files

    143

    Last publish

    Collaborators

    • reside-eng