Expanded config for more options

csp-policy.yml

@@ -5,6 +5,10 @@
 #      script-src 'self' example.com;object-src 'none';
 #      upgrade-insecure-requests"
 # Note: embedded single quotes are required
+xFrameOptions: SAMEORIGIN
+contentSecurityPolicy:
+  useDefaults: false
+  directives:
     default-src: [ "'self'" ]
     base-uri: [ "'self'" ]
     font-src:

index.cjs

@@ -7,11 +7,5 @@ module.exports = (path) => {
   const csppolicy = fs.readFileSync(path, 'utf8')
   const csp = YAML.parse(csppolicy)
 
-  return helmet({
-    contentSecurityPolicy: {
-      useDefaults: false,
-      directives: csp,
-    },
-    xFrameOptions: 'SAMEORIGIN',
-  })
+  return helmet(csp)
 }

test/index.test.js

@@ -19,6 +19,8 @@ describe('Rapid configurable Content Security Policy middleware', () => {
     fs.writeFileSync(
       customPolicyPath,
       `
+contentSecurityPolicy:
+  directives:
     default-src: ["'self'"]
     script-src: ["'self'", "https://cdn.example.com"]
     `,