Middleware

security:csrf

This middleware is a tiny wrapper around Koa CSRF: it provides CSRF support for your application.

By default, the following options serve as default:

{
  "invalidSessionSecretMessage": "Invalid session secret",
  "invalidSessionSecretStatusCode": 403,
  "invalidTokenMessage": "Invalid CSRF token",
  "invalidTokenStatusCode": 403,
  "excludedMethods": ["GET", "HEAD", "OPTIONS"],
  "disableQuery": false
}

To change globally, edit the configuration in security.json in your config directory (<DDIR>/config) as shown below:

{
  "cuks": {
    "http": {
      "middleware": {
        "csrf": {
          // your global CSRF options here
        }
      }
    }
  }
}

To change options individually (per route call), please read here.

Inside your CUK Route file:

...
return {
  method: 'POST',
  middleware: "http:bodyParser, security:csrf",
  handler: ctx => {
    ...
  }
}
...

And don't forget to put CSRF token on your form template as shown here

security:helmet

Helmet is a collection of 12 middleware to help set some security headers.

This CUK middleware is a tiny wrapper arround koa-helmet which is Koa implementation of the fore mention middleware.

Use security:helmet<Name> instead to get the standalone version, where name is one of the keys in options.

By default, the following options serve as default:

{
  "contentSecurityPolicy": false,
  "expectCt": false,
  "dnsPrefetchControl": true,
  "frameguard": true,
  "hidePoweredBy": true,
  "hpkp": false,
  "hsts": false,
  "ieNoOpen": true,
  "noCache": false,
  "noSniff": true,
  "referrerPolicy": false,
  "xssFilter": true
}

To change globally, edit the configuration in security.json in your config directory (<DDIR>/config) as shown below:

{  
  "cuks": {
    "http": {
      "middleware": {        
        "helmet": {          
          // your global helmet options here        
        }      
      }    
    }  
  }
}

To change options individually (per route call), please read here.

Putting false on one of the options above means disabling the named middleware, while true means enabling it with its default options. Consult helmet documentations for custom options.

If you put custom options on one or more keys above, those options will also be use as global options for the standalone versions.

Inside your CUK Route file:

...
return {  
  middleware: "security:helmet",  
  handler: ctx => {    
    ...  
  }
}
...

security:contentSecurityPolicy

This is the standalone version of helmet's Content Security Policy.

Inside your CUK Route file:

...
return {  
  middleware: "security:contentSecurityPolicy",  
  handler: ctx => {    
    ...  
  }
}
...

security:dnsPrefetchControl

This is the standalone version of helmet's DNS Prefetch Control.

Inside your route file:

...
return {  
  middleware: "security:helmetDnsPrefetchControl",  
  handler: ctx => {    
    ...  
  }
}
...

security:expectCt

This is the standalone version of helmet's Expect CT.

Inside your route file:

...
return {  
  middleware: "security:expectCt",  
  handler: ctx => {    
    ...  
  }
}
...

security:frameguard

This is the standalone version of helmet's Frameguard.

Inside your route file:

...
return {  
  middleware: "security:frameguard",  
  handler: ctx => {    
    ...  
  }
}
...

security:hidePoweredBy

This is the standalone version of helmet's Hide Powered By.

Inside your route file:

...
return {  
  middleware: "security:hidePoweredBy",  
  handler: ctx => {    
    ...  
  }
}
...

security:hpkp

This is the standalone version of helmet's HPKP.

Inside your route file:

...
return {  
  middleware: "security:hpkp",  
  handler: ctx => {    
    ...  
  }
}
...

security:hsts

This is the standalone version of helmet's HSTS.

Inside your route file:

...
return {  
  middleware: "security:hsts",  
  handler: ctx => {    
    ...  
  }
}
...

security:ieNoOpen

This is the standalone version of helmet's IE No Open.

Inside your route file:

...
return {  
  middleware: "security:ieNoOpen",  
  handler: ctx => {    
    ...  
  }
}
...

security:noCache

This is the standalone version of helmet's No Cache.

Inside your route file:

...
return {  
  middleware: "security:noCache",  
  handler: ctx => {    
    ...  
  }
}
...

security:noSniff

This is the standalone version of helmet's No Sniff.

Inside your route file:

...
return {  
  middleware: "security:noSniff",  
  handler: ctx => {    
    ...  
  }
}
...

security:referrerPolicy

This is the standalone version of helmet's Referrer Policy.

Inside your route file:

...
return {  
  middleware: "security:referrerPolicy",  
  handler: ctx => {    
    ...  
  }
}
...

security:xssFilter

This is the standalone version of helmet's XSS Filter

Inside your route file:

...
return {  
  middleware: "security:xssFilter",  
  handler: ctx => {    
    ...  
  }
}
...

Previous@rappopo/cuk-security NextView Globals

Last updated 5 years ago