@jackdbd/content-security-policy
Advanced tools
Write your Content-Security-Policy header in JavaScript, so you can have validation and automatic hashes.
Write your Content-Security-Policy header in JavaScript, so you can have validation and automatic hashes.
A strict Content-Security-Policy is probably the single most important line of defense against Cross-Site Scripting (XSS) attacks.
Unfortunately, writing a good CSP header by hand is a pain. Here is why:
Also, you should:
This package validates your Content-Security-Policy directives and computes a cryptographic hash (SHA-256, SHA-384 or SHA-512) for each snippet of CSS/JS that you inline in your HTML file.
npm install @jackdbd/content-security-policy
Let's suppose you have an Eleventy site that has the following characteristics:
<head>If your Eleventy site was generated in the _site folder, you could generate a Content-Security-Policy header with this code:
import path from 'node:path'
import { cspHeader } from '@jackdbd/content-security-policy'
const directives = {
'base-uri': ['self'],
'default-src': ['none'],
'font-src': ['self'],
'img-src': ['self', 'cdn.example.com'],
'script-src-attr': ['self', 'unsafe-hashes', 'sha256'],
'style-src-elem': ['self']
}
const patterns = [path.join('_site', '**/*.html')]
const header = await cspHeader({ directives, patterns })
The Content-Security-Policy header is made of directives. If you don't know where to start, use one of the following policies:
import {
starter_policy,
recommended_policy
} from '@jackdbd/content-security-policy/policies'
const directives = recommended_policy
| Key | Default | Description |
|---|---|---|
directives | undefined | Directives for your Content-Security-Policy (or Content-Security-Policy-Report-Only). |
patterns | undefined | Glob patterns for your .html files. |
base-uri, child-src, connect-src, default-src, font-src, form-action, frame-ancestors, frame-src, img-src, manifest-src, media-src, navigate-to, object-src, report-to, sandbox, script-src, script-src-attr, script-src-elem, source-values, style-src, style-src-attr, style-src-elem, upgrade-insecure-requests, worker-src
block-all-mixed-content, plugin-types, prefetch-src, referrer, report-uri, require-sri-for
fenced-frame-src, require-trusted-types-for, trusted-types
📖 API Docs
This project uses API Extractor and api-documenter markdown to generate a bunch of markdown files and a
.d.tsrollup file containing all type definitions consolidated into a single file. I don't find this.d.tsrollup file particularly useful. On the other hand, the markdown files that api-documenter generates are quite handy when reviewing the public API of this project.See Generating API docs if you want to know more.
| Package | Version |
|---|---|
| debug | ^4.3.4 |
| globby | ^14.0.1 |
| himalaya | ^1.1.0 |
| zod | ^3.23.4 |
This project is tested on Node.js >=14.21.3.
You can use a Node.js version manager like nvm, asdf or volta to manage your Node.js versions.
This project uses the debug library for logging.
You can control what's logged using the DEBUG environment variable.
For example, if you set your environment variables in a .envrc file, you can do:
# print all logging statements
export DEBUG=csp:*
_headers file. Really cool, but you have to host you site on Netlify to use it.© 2022 - 2024 Giacomo Debidda // MIT License
FAQs
Write your Content-Security-Policy header in JavaScript, so you can have validation and automatic hashes.
The npm package @jackdbd/content-security-policy receives a total of 49 weekly downloads. As such, @jackdbd/content-security-policy popularity was classified as not popular.
We found that @jackdbd/content-security-policy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Company News
Socket is joining TC54 to help develop standards for software supply chain security, contributing to the evolution of SBOMs, CycloneDX, and Package URL specifications.
Security News
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
Research
Security News
Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.