ExpressJS Series: Helmet CSP usage

expressjs-helmet-csp-index.js

const express = require('express');
const bodyParser = require('body-parser');
const helmet = require('helmet');
const csp = require('helmet-csp');

let app = express();

// Implementing basic security defaults using helmet
app.use(helmet());
// CSP Options
const cspOptions = csp({
  directives: {
    defaultSrc: ["'self'", 'defaultsomeextradomainmaynotbeneeded.com'], // If any sources are not specified will allow from this
    scriptSrc: ["'self'", "'unsafe-inline'", 'yourcdnlike.bootstrapcdn.com'], // Domains and places allowed for scripts
    styleSrc: ["'self'", "'unsafe-inline'", 'yourcdnlike.bootstrapcdn.com'], // Domains and places allowed for styles
    imgSrc: ["'self'", 'yourcdnlike.bootstrapcdn.com'], // Domains and places allowed for images
    reportUri: '/report-violation', // Modern browsers will report violations to this URI in your application
    objectSrc: ["'none'"], // Domains allowed for <object>, <embed>, and <applet> elements
    mediaSrc: ["'self'", 'yourcdnlike.bootstrapcdn.com'], // Domains allowed for <Audio> and <video> html tags
    fontSrc: ["'self'", 'yourcdnlike.bootstrapcdn.com'], // Domains allowed for fonts
    upgradeInsecureRequests: true, // Upgrade to HTTPS if you are have certificates and running HTTPS
    workerSrc: false,  // This is not set.
    browserSniff: false, // Will disable browser sniffing
  }
});
// Implement Content Security Policy - Standard configuration
app.use(cspOptions);

// parse application/x-www-form-urlencoded
app.use(bodyParser.urlencoded({ extended: false }));
 
// parse application/json
app.use(bodyParser.json());

const myFirstMiddleware = function(req, res, next) {
  console.log('My logger');
  next();
};

const myRouteMiddleware = function(req, res, next) {
  console.log('My logger ', 'only for ', req.path);
  next();
};

app.use(myFirstMiddleware);

app.post('/report-violation', function (req, res) {
  if (req.body) {
    console.log('CSP Violation: ', req.body);
  } else {
    console.log('CSP Violation: No data received!');
  }
  res.status(204).end();
});

app.get('/', function(req, res) {res.status(200).send({status: "running", time: Date.now()})});
/* POST */
app.post('/', myRouteMiddleware, function(req, res) {res.status(200).send({status: "running", time: Date.now()})});
/* PUT */
app.put('/', function(req, res) {res.status(200).send({status: "running", time: Date.now()})});
/* PATCH */
app.patch('/', function(req, res) {res.status(200).send({status: "running", time: Date.now()})});
/* DELETE */
app.delete('/', function(req, res) {res.status(200).send({status: "running", time: Date.now()})});
/* OPTIONS */
/*
app.options('/', function(req, res) {res.status(200).send({status: "running", time: Date.now()})});
*/
app.post('/api/myform/:categoryId', function(req, res) {
  res.status(200).send({paramValues: req.params.categoryId, queryParamValues: req.query.create + ' ' + req.query.notify});
});

const host = "127.0.0.1";
const port = 9001;
app.listen(host, port, function() {console.log("Server started")});