Content Security Policy helps prevent unwanted content being injected into your webpages; this can mitigate cross-site scripting (XSS) vulnerabilities, malicious frames, unwanted trackers, and more. If you want to learn how CSP works, check out the fantastic HTML5 Rocks guide, the Content Security Policy Reference, and the Content Security Policy specification. This module helps set Content Security Policies.
var csp =app
There are a lot of inconsistencies in how browsers implement CSP. Helmet looks at the user-agent of the browser and sets the appropriate header and value for that browser. If no user-agent is matched, it will set all the headers with the 2.0 spec.
report-uri directive will also set the new
report-to directive for forwards compatibility.
If you've specified a
reportUri, browsers will POST any CSP violations to your server. Here's a simple example of a route that handles those reports:
// You need a JSON parser first.appapp
Not all browsers send CSP violations in the same way, so this might require a little work.
Note: If you're using a CSRF module like csurf, you might have problems handling these violations without a valid CSRF token. The fix is to put your CSP report route above csurf middleware.
You can dynamically generate nonces to allow inline
<script> tags to be safely evaluated. Here's a simple example:
var uuid =appappapp
The default behavior of CSP is generate headers tailored for the browser that's requesting your page. If you have a CDN in front of your application, the CDN may cache the wrong headers, rendering your CSP useless. Make sure to eschew a CDN when using this module or set the
browserSniff option to