@mashroom/mashroom-helmet

Mashroom Helmet

Plugin for Mashroom Server, a Integration Platform for Microfrontends.

This plugin adds the Helmet middleware which sets a bunch of protective HTTP headers on each response.

Usage

If node_modules/@mashroom is configured as plugin path just add @mashroom/mashroom-helmet as dependency.

You can override the default config in your Mashroom config file like this:

{
    "plugins": {
        "Mashroom Helmet Middleware": {
            "helmet": {
                "contentSecurityPolicy": false,
                "dnsPrefetchControl ": {
                    "allow": false
                },
                "expectCt": false,
                "featurePolicy": false,
                "frameguard": {
                    "action": "deny"
                },
                "hidePoweredBy": false,
                "hsts": {
                    "maxAge": 31536000
                },
                "ieNoOpen": false,
                "noSniff": {},
                "permittedCrossDomainPolicies": false,
                "referrerPolicy": false,
                "xssFilter": {
                    "mode": null
                }
            }
        }
    }
}

• helmet: The configuration will directly be passed to Helmet middelware. Checkout the Helmet Documentation for available options. You should enable the noCache module because this would significantly decrease the performance of the Mashroom Portal.

Changelog

1.9.0 (October 18, 2021)

• Portal: BREAKING CHANGE: Removed portalBasePath from the page render model because it doesn't make sense in combination with the vhost path mapper. Only use siteBasePath.
• Portal: Client log messages contain now the path of the page where they were generated
• K8S Remote App Registry: Added the possibility to filter services by label selectors Example:

    "k8sNamespacesLabelSelector": "environment=development,tier=frontend",
    "k8sNamespaces": null,
    "k8sServiceLabelSelector": "microfrontend=true,channel!=alpha"
  

• K8S Remote App Registry: Added the possibility to scan in namespaces identified by a labelSelector. Example: Scan all services in namespaces with label environment=development and microfrontend in the name:

    "k8sNamespacesLabelSelector": "environment=development",
    "k8sNamespaces": null,
    "serviceNameFilter": "(microfrontend-)",
  

• Portal: BREAKING CHANGE: Removed MashroomRestService from client services because it is only intended for internal use. Portal Apps should use fetch directly.
• Default Theme: Added an SPA mode where the theme will try to operate like an SPA and loads new page content via AJAX and replaces the DOM. This only works until the user does not navigate on a page with a different theme or different page enhancements, in that case a full page load is triggered.
• Portal: Added an API endpoint to just fetch the page content without header, navigation, page enhancements and so on. This can be used for themes that work like an SPA. Example: http://localhost:5050/portal/web/___/api/pages/test2/content?currentPageId=subpage1 Means: Give me the content (and scripts to launch/hydrate the Apps) for page test2, and I'm currently on page subpage1, tell me if I need a full page load because the theme or something else outside the content area is different.
• Portal: Initial pages are now completely rendered on the server side (including the App wrapper). To make it more clear that not only the layout is rendered anymore, the property portalLayout in the render model has been deprecated and the new property pageContent should be used instead.
• Portal: It is now possible to define how to render an App and errors during App loading are rendered in the theme. You just need to add the new views appWrapper and appError. The content of appWrapper could look like this (when using Handlebars):

  <div id="portal-app-{{appId}}" class="mashroom-portal-app-wrapper portal-app-{{safePluginName}}">
    <div class="mashroom-portal-app-header">
      <div class="mashroom-portal-app-header-title" data-replace-content="title">{{title}}</div>
    </div>
    <div class="mashroom-portal-app-host" data-replace-content="app">
     {{#if appSSRHtml}}
       {{{appSSRHtml}}}
     {{else}}
       <div class="mashroom-portal-app-loading"><span/></div>
     {{/if}}
   </div>
  </div>
  

  BREAKING CHANGE: Previously it was possible to customize the App wrapper and error message using the client side functions MashroomPortalCreateAppWrapperFunc and MashroomPortalCreateLoadingErrorFunc - those are ignored now.
• Default Theme: Added a flag (showPortalAppHeaders) to the config to be able to hide the App headers
• Admin App: Show/Hide App Control is now persisted during page navigation
• Added a demo Composite App: Demonstrates the possibility to use existing Apps as building blocks within other Apps. Basically it uses the MashroomPortalAppService to tell the Portal where it should place an App with a given name and a custom appConfig. Additional it demonstrates how such a Composite App can have a "private" message bus.
• Portal: BREAKING CHANGE: Removed sendUserHeaders and addHeaders from the proxy config of Portal Apps because both should be done via HTTP Proxy Interceptor now. If you were using sendUserHeaders just add mashroom-http-proxy-add-user-headers to your plugins.
• Added a plugin to add the ID/JWT token to backend requests if OpenID connect is used (mashroom-http-proxy-add-id-token)
• Added a plugin to add user data as headers to backend requests (mashroom-http-proxy-add-user-headers)
• HTTP Proxy: The HTTP interceptor can now also process WebSocket upgrade requests (added optional method interceptWsRequest())
• MongoDB client upgraded to v4 BREAKING CHANGE: If you use mashroom-session-provider-mongodb or mashroom-storage-provider-mongodb please check your connection options since they have changed. E.g. poolSize and useUnifiedTopology no longer exist. Check out https://mongodb.github.io/node-mongodb-native/4.1/classes/MongoClient.html#options
• Admin App: Bundle size cut in halve, loads now faster
• Sandbox App: It is possible now to search for Apps (autocomplete)
• Portal: Fixed the problem that pages with special characters (like Umlaute) in their path didn't work