loopback4-helmet

loopback4-helmet

A simple loopback-next extension for helmetjs integration in loopback applications.

Install

npm install loopback4-helmet

Usage

In order to use this component into your LoopBack application, please follow below steps.

• Add component to application.

this.component(Loopback4HelmetComponent);

• By default, helmet will be initialized with only the default middlewares enabled as per here. However, you can override any of the middleware settings using the Config Binding like below.

this.bind(HelmetSecurityBindings.CONFIG).to({
  referrerPolicy: {
    policy: 'same-origin',
  },
  contentSecurityPolicy: {
    directives: {
      frameSrc: ["'self'"],
    },
  },
});

• The component exposes a sequence action which can be added to your server sequence class. Adding this will trigger helmet middleware for all the requests passing through.

export class MySequence implements SequenceHandler {
  constructor(
    @inject(SequenceActions.FIND_ROUTE) protected findRoute: FindRoute,
    @inject(SequenceActions.PARSE_PARAMS) protected parseParams: ParseParams,
    @inject(SequenceActions.INVOKE_METHOD) protected invoke: InvokeMethod,
    @inject(SequenceActions.SEND) public send: Send,
    @inject(SequenceActions.REJECT) public reject: Reject,
    @inject(HelmetSecurityBindings.HELMET_SECURITY_ACTION)
    protected helmetAction: HelmetAction,
  ) {}

  async handle(context: RequestContext) {
    const requestTime = Date.now();
    try {
      const {request, response} = context;
      const route = this.findRoute(request);
      const args = await this.parseParams(request, route);

      // Helmet Action here
      await this.helmetAction(request, response);

      const result = await this.invoke(route, args);
      this.send(response, result);
    } catch (err) {
      ...
    } finally {
      ...
    }
  }
}

Feedback

If you've noticed a bug or have a question or have a feature request, search the issue tracker to see if someone else in the community has already created a ticket. If not, go ahead and make one! All feature requests are welcome. Implementation time may vary. Feel free to contribute the same, if you can. If you think this extension is useful, please star it. Appreciation really helps in keeping this project alive.

Contributing

Please read CONTRIBUTING.md for details on the process for submitting pull requests to us.

Code of conduct

Code of conduct guidelines here.

License

MIT

Changelog

Release v4.2.1 February 20, 2023

Welcome to the February 20, 2023 release of loopback4-helmet. There are many updates in this version that we hope you will like, the key highlights include:

• Correct the changelog Format :- fix(chore): correct the changelog format was commited on February 20, 2023 by yeshamavani

  • • fix(chore): correct the changelog format

  • now issue description will be visible

  • GH-68

  • • chore(deps): upgrading the packages version

  • upgraded helmet and cookiejar

  • GH-68

• Package Update : loopback4-helmet :- fix(chore): remove all current vulnerability of loopback4-helmet was commited on February 20, 2023 by Sunny Tyagi

  • remove all current vulnerability of loopback4-helmet

  • GH-66

Clink on the above links to understand the changes in detail.

---