Etherpad plugin to bring in helmet. Helmet provides security for express. See the Helmet docs for it's capabilities. Helmet also brings iFrame embed capabilities into Etherpad.
Usage
Basic usage is simple, just install the plugin.
Advanced usage.
Just use the same settings Helmet exposes for CSP.
CSP
"ep_helmet":{
"csp":{
"directives": {
"objectSrc": ["'none'"],
"upgradeInsecureRequests": true,
"workerSrc": false
}
}
}
The above CSP will need to be polished over time https://ponyfoo.com/articles/content-security-policy-in-express-apps is a good write up that needs to be referred to and supported
Frameguard
Frameguard can be used to set X-Frame-Options which is useful if you embed Etherpad in an iFrame.
"ep_helmet":{
"frameguard":{
"action": "allow-from",
"domain": "https://DOMAINIFRAMEWILLBEHOSTEDIN.com"
}
}
Todo
- [ ] Provide a good CSP example for Etherpad
- [ ] Provide improves security for Etherpad (using nonce example etc for inline)
License
Apache 2