New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More
Socket
Sign inDemoInstall
Socket

hpkp

Package Overview
Dependencies
Maintainers
1
Versions
11
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

hpkp - npm Package Compare versions

Comparing version 2.0.2 to 2.0.3

82

index.js

@@ -1,34 +0,42 @@

module.exports = function hpkp (passedOptions) {
var options = parseOptions(passedOptions)
var headerName = getHeaderName(options)
var headerValue = getHeaderValue(options)
module.exports = function hpkp(passedOptions) {
var options = parseOptions(passedOptions);
var headerName = getHeaderName(options);
var headerValue = getHeaderValue(options);
return function hpkp (req, res, next) {
return function hpkp(req, res, next) {
if (options.setIf(req, res)) {
res.setHeader(headerName, headerValue)
res.setHeader(headerName, headerValue);
}
next();
};
};
next()
function parseOptions(options) {
var badArgumentsError = new Error(
"hpkp must be called with a maxAge and at least two SHA-256s (one actually used and another kept as a backup)."
);
if (
!options ||
(options.maxage && options.maxAge) ||
(options.reportOnly && !options.reportUri)
) {
throw badArgumentsError;
}
}
function parseOptions (options) {
var badArgumentsError = new Error('hpkp must be called with a maxAge and at least two SHA-256s (one actually used and another kept as a backup).')
var maxAge = options.maxAge;
var sha256s = options.sha256s;
var setIf =
options.setIf ||
function () {
return true;
};
if (!options) { throw badArgumentsError }
if (options.maxage && options.maxAge) { throw badArgumentsError }
var maxAge = options.maxAge
var sha256s = options.sha256s
var setIf = options.setIf || function () { return true }
if (!maxAge || maxAge <= 0) { throw badArgumentsError }
if (!sha256s || sha256s.length < 2) { throw badArgumentsError }
if (typeof setIf !== 'function') {
throw new TypeError('setIf must be a function.')
if (!maxAge || maxAge <= 0 || !sha256s || sha256s.length < 2) {
throw badArgumentsError;
}
if (typeof setIf !== "function") {
throw new TypeError("setIf must be a function.");
}
if (options.reportOnly && !options.reportUri) { throw badArgumentsError }
return {

@@ -40,26 +48,26 @@ maxAge: maxAge,

reportOnly: options.reportOnly,
setIf: setIf
}
setIf: setIf,
};
}
function getHeaderName (options) {
var header = 'Public-Key-Pins'
function getHeaderName(options) {
var header = "Public-Key-Pins";
if (options.reportOnly) {
header += '-Report-Only'
header += "-Report-Only";
}
return header
return header;
}
function getHeaderValue (options) {
function getHeaderValue(options) {
var result = options.sha256s.map(function (sha) {
return 'pin-sha256="' + sha + '"'
})
result.push('max-age=' + Math.round(options.maxAge))
return 'pin-sha256="' + sha + '"';
});
result.push("max-age=" + Math.round(options.maxAge));
if (options.includeSubDomains) {
result.push('includeSubDomains')
result.push("includeSubDomains");
}
if (options.reportUri) {
result.push('report-uri="' + options.reportUri + '"')
result.push('report-uri="' + options.reportUri + '"');
}
return result.join('; ')
return result.join("; ");
}

@@ -10,3 +10,3 @@ {

"description": "HTTP Public Key Pinning (HPKP) middleware",
"version": "2.0.2",
"version": "2.0.3",
"keywords": [

@@ -33,3 +33,7 @@ "helmet",

"scripts": {
"pretest": "standard",
"pretest": "npm run lint",
"lint": "npm run lint:eslint && npm run lint:prettier",
"lint:eslint": "eslint .",
"lint:prettier": "prettier --check .",
"format": "prettier --write .",
"test": "mocha"

@@ -39,13 +43,7 @@ },

"connect": "^3.7.0",
"mocha": "^8.3.2",
"standard": "^16.0.3",
"supertest": "^6.1.3"
},
"standard": {
"global": [
"beforeEach",
"describe",
"it"
]
"eslint": "^8.7.0",
"mocha": "^9.2.0",
"prettier": "^2.5.1",
"supertest": "^6.1.6"
}
}

Sorry, the diff of this file is not supported yet

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc