Fastify-csp NPM

fastify-csp

Fastify plugin to set Content-Security-Policy header.

Why?

You may know csp as a csp middleware used in helmet. And you could use it as a middleware in fastify also. So why i made this plugin?

You may find the reason in benchmark result and wish you like it. :)

Difference

This plugin has passed all csp test cases. But there are some differences to csp:

Don't support kebab case directive name. All directive name shoud be in camel case.
Use lru cache for static policy generation which won't effect dynamic situation.

Install

Via npm:

npm i fastify-csp

Via yarn:

yarn add fastify-csp

Usage

const fastify = require('fastify');
const fastifyCsp = require('fastify-csp');

const app = fastify();
app.register(fastifyCsp, {
  directives: {
    defaultSrc: ["'self'"]
  }
  // e.t.c
});

app.listen(3000, err => {
  if (err) throw err;
});

Options

This plugin has the same options as the middleware in helmet. To learn more, you may check out the spec or reference guide.

directives {object}

This option is required.

All directive name shoud be in camel case.

Specify directives with at least one directive field. Supported directives:

baseUri (as base-url)
blockAllMixedContent (as block-all-mixed-content)
childSrc (as child-src)
connectSrc (as connect-src)
defaultSrc (as default-src)
fontSrc (as font-src)
formAction (as form-action)
frameAncestors (as frame-ancestors)
frameSrc (as frame-src)
imgSrc (as img-src)
manifestSrc (as manifest-src)
mediaSrc (as media-src)
objectSrc (as object-src)
pluginTypes (as plugin-types)
prefetchSrc (as prefetch-src)
reportTo (as report-to)
reportUri (as report-uri)
requireSriFor (as require-sri-for)
sandbox (as sandbox)
scriptSrc (as script-src)
styleSrc (as style-src)
upgradeInsecureRequests (as upgrade-insecure-requests)
workerSrc (as worker-src)

loose {boolean}

Default is false.

This module will detect common mistakes in your directives and throw errors if finds any. To disable this, set true to loose option.

reportOnly {boolean|function}

Default is false.

Set to true if you only want browsers to report errors, not block them. You may also set this to a function(request, reply) in order to decide dynamically whether to use reportOnly mode, e.g., to allow for a dynamic kill switch.