express-security-txt

Express Security Txt

Express middleware that implements a security.txt path and policy

References:

• security.txt rfc
• security.txt project on github

Installation

yarn add express-security-txt

Usage

Define an options object with the proper fields that make up a valid security.txt policy, and use it as a middleware for an express app.

const securityTxt = require('express-security-txt')

const options = {
  contact: 'mailto:[e-mail]',
  encryption: 'https://www.mykey.com/pgp-key.txt',
  acknowledgement: 'thank you'
}

app.use(securityTxt.setup(options))

Chaining

Where allowed, you can provide multiple values for a single directive by passing an array.

const securityTxt = require('express-security-txt')

const options = {
  contact: [
    'https://firstMethodOfContact.example.com',
    'https://secondMethodOfContact.example.com'
  ]
}

app.use(securityTxt.setup(options))

Comments

To add a comment at the beggining or end of the security.txt file, one may use the keys _prefixComment and _postfixComment respectively. If one wishes to place a comment immediately before a field, one may use an object which specifies the value of the field and the comment which must come before it.

const securityTxt = require('express-security-txt')

const options = {
  _prefixComment: 'This comment goes at the very beggining of the file',
  contact: {
    comment: 'This comment goes directly before the Contact: directive',
    value: 'mailto:[e-mail]'
  },
  encryption: [
    'https://example.com/encryption',
    {
      comment: 'Comments can appear in the middle of an array of values',
      value: 'https://example.com/alternativeEncryption'
    }
  ],
  _postfixComment: 'This comment goes at the very end of the file'
}

app.use(securityTxt.setup(options))

Would generate the file

# This comment goes at the very beggining of the file
# This comment goes directly before the Contact: directive
Contact: mailto:[e-mail]
Encryption: https://example.com/encryption
# Comments can appear in the middle of an array of values
Encryption: https://example.com/alternativeEncryption
# This comment goes at the very end of the file

If your comment spans multiple lines, you can use \n to split it. express-security-txt will automatically insert the relevant # symbols. Alternatively, one can use an array of lines instead of a string.

For example:

const options = {
  _prefixComment: ['this is a', 'comment\nwhich', 'spans many lines'],
  contact: 'mailto:[e-mail]'
}

Would generate

# this is a
# comment
# which
# spans many lines
Contact: mailto:[e-mail]

Tests

Project tests:

yarn run test

Project linting:

yarn run lint

Contributing

Commit Guidelines

The project uses the commitizen tool for standardizing changelog style commit messages so you should follow it as so:

git add .           # add files to staging
yarn run commit      # use the wizard for the commit message