loopback4-helmet

loopback4-helmet

A simple loopback-next extension for helmetjs integration in loopback applications.

Install

npm install loopback4-helmet

Usage

In order to use this component into your LoopBack application, please follow below steps.

• Add component to application.

this.component(Loopback4HelmetComponent);

• By default, helmet will be initialized with only the default middlewares enabled as per here. However, you can override any of the middleware settings using the Config Binding like below.

this.bind(HelmetSecurityBindings.CONFIG).to({
  referrerPolicy: {
    policy: 'same-origin',
  },
  contentSecurityPolicy: {
    directives: {
      frameSrc: ["'self'"],
    },
  },
});

• The component exposes a sequence action which can be added to your server sequence class. Adding this will trigger helmet middleware for all the requests passing through.

export class MySequence implements SequenceHandler {
  constructor(
    @inject(SequenceActions.FIND_ROUTE) protected findRoute: FindRoute,
    @inject(SequenceActions.PARSE_PARAMS) protected parseParams: ParseParams,
    @inject(SequenceActions.INVOKE_METHOD) protected invoke: InvokeMethod,
    @inject(SequenceActions.SEND) public send: Send,
    @inject(SequenceActions.REJECT) public reject: Reject,
    @inject(HelmetSecurityBindings.HELMET_SECURITY_ACTION)
    protected helmetAction: HelmetAction,
  ) {}

  async handle(context: RequestContext) {
    const requestTime = Date.now();
    try {
      const {request, response} = context;
      const route = this.findRoute(request);
      const args = await this.parseParams(request, route);

      // Helmet Action here
      await this.helmetAction(request, response);

      const result = await this.invoke(route, args);
      this.send(response, result);
    } catch (err) {
      ...
    } finally {
      ...
    }
  }
}

Feedback

If you've noticed a bug or have a question or have a feature request, search the issue tracker to see if someone else in the community has already created a ticket. If not, go ahead and make one! All feature requests are welcome. Implementation time may vary. Feel free to contribute the same, if you can. If you think this extension is useful, please star it. Appreciation really helps in keeping this project alive.

Contributing

Please read CONTRIBUTING.md for details on the process for submitting pull requests to us.

Code of conduct

Code of conduct guidelines here.

License

MIT

Changelog

Release v5.0.0 June 7, 2023

Welcome to the June 7, 2023 release of loopback4-helmet. There are many updates in this version that we hope you will like, the key highlights include:

• Loopback version update :- chore(deps): loopback version update was commited on May 19, 2023 by RaghavaroraSF

  • loopback version update

  • GH-74

• Remove support for node v14 :- feat(chore): remove support for node v14,v12,v10 was commited on May 11, 2023 by RaghavaroraSF

  • version 14, v12, v10, v8 of Nodejs reached its end of life

  • BREAKING CHANGE:

  • End of life of node v14, node v12, node v10 and node v8

  • GH-78

• License and Copyright Headers’ Year Upgradation :- chore(maintenance): update license and copyright headers was commited on May 4, 2023 by RaghavaroraSF

  • to reflect the year change

  • GH-76

Clink on the above links to understand the changes in detail.

---