express-csp-header - npm Package Compare versions

Comparing version 2.0.0 to 2.0.1

index.js

@@ -0,1 +1,2 @@
+'use strict';
 var cspHeader = require('csp-header');
@@ -2,0 +3,0 @@ var crypto = require('crypto');

package.json

 {
   "name": "express-csp-header",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Content-Security-Policy middleware for Express",
@@ -34,5 +34,5 @@ "main": "index.js",
   "dependencies": {
-    "csp-header": "^1.0.0",
+    "csp-header": "^1.0.1",
     "parse-domain": "^0.2.1"
   }
 }

README.md

@@ -73,2 +73,22 @@ # Content-Security-Policy middleware for Express
 
+### Presets
+
+Your policies can also be extended by presets. Presets are npm-modules containing CSP rules and prefixed by ``csp-preset``. Example of preset:
+
+```js
+module.exports = {
+	'connect-src': ['my-super-service.com'],
+	'style-src': ['my-super-service.com']
+};
+```
+
+Presets can be easely applied to existing CSP rules by ``presets`` property:
+
+```js
+app.use(csp({
+    policies: myCSPPolicies,
+    presets: ['yandex-metrika', 'google-analytics'] // csp-preset-yandex-metrika and csp-preset-google-analytics will be apllied
+}));
+```
+
 ### Content-Security-Policy-Report-Only mode
@@ -115,20 +135,1 @@
 ```
-
-### Release notes:
-
-#### v1.2.1
- * fix leaking to global scope by [@i-akhmadullin](https://github.com/i-akhmadullin)
-
-#### v1.2.0
- * new csp-header with CSP 3
-
-#### v1.1.0
- * Policies extending
-
-#### v1.0.0:
-
- * All arguments combined into single ``params`` argument
- * Added boolean param ``reportOnly`` that switches on Content-Security-Policy-Report-Only mode
-
-#### v0.1.0:
- * Dynamic tld (thanks to [@msmirnov](https://github.com/msmirnov))

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Lines of code

187

increased by0.54%

Number of lines in readme file

134

increased by0.75%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

100138

decreased by-0.05%

Dependency changes

• Updatedcsp-header@^1.0.1