Rapid configurable Content Security Policy middleware
| test | ||
| .gitignore | ||
| .prettierrc | ||
| csp-policy.yml | ||
| index.cjs | ||
| index.mjs | ||
| LICENSE | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
express-csp
Rapid, configurable Content Security Policy middleware for Express, powered by Helmet and simple YAML configuration.
Features
- Secure defaults with CSP via
helmet - Configuration in clean, readable YAML
- Easily swappable policies per environment
- Fully tested with Jest & Supertest
Installation
npm install helmet yaml
npm install --save-dev jest supertest
Usage
const express = require('express')
const csp = require('express-csp')
const app = express()
const policyPath = './csp-policy.yml'
app.use(csp(policyPath))
app.get('/', (req, res) => res.send('Secure by CSP!'))
app.listen(3000)
Sample Policy
default-src: ["'self'"]
script-src:
- "'self'"
- example.com
style-src:
- "'self'"
- "https:"
- "'unsafe-inline'"
img-src:
- "'self'"
- "data:"
object-src: ["'none'"]
upgrade-insecure-requests: []
License
ISC License
Contributing
PRs welcome! For bugs or suggestions, open an issue.