fastify-helmet - npm Package Compare versions

Comparing version 5.1.0 to 5.2.0

index.js

@@ -18,1 +18,3 @@ 'use strict'
 })
+
+module.exports.contentSecurityPolicy = helmet.contentSecurityPolicy

package.json

 {
   "name": "fastify-helmet",
-  "version": "5.1.0",
+  "version": "5.2.0",
   "description": "Important security headers for Fastify",
@@ -5,0 +5,0 @@ "main": "index.js",

test.js

@@ -110,1 +110,28 @@ 'use strict'
 })
+test('default CSP directives can be accessed through plugin export', (t) => {
+  const fastify = Fastify()
+
+  fastify.register(helmet, {
+    contentSecurityPolicy: {
+      directives: {
+        ...helmet.contentSecurityPolicy.getDefaultDirectives()
+      }
+    }
+  })
+
+  fastify.get('/', (request, reply) => {
+    reply.send({ hello: 'world' })
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (err, res) => {
+    t.error(err)
+
+    const expected = { 'content-security-policy': 'default-src \'self\';base-uri \'self\';block-all-mixed-content;font-src \'self\' https: data:;frame-ancestors \'self\';img-src \'self\' data:;object-src \'none\';script-src \'self\';script-src-attr \'none\';style-src \'self\' https: \'unsafe-inline\';upgrade-insecure-requests' }
+
+    t.include(res.headers, expected)
+    t.end()
+  })
+})

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

11842

increased by8.21%

Lines of code

233

increased by11.48%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes