Merge pull request #235 from bcgov/security/helmet

Implement Helmet content security policy
bcgov · Dec 18, 2023 · 3e47e16 · 3e47e16
2 parents 687361d + 411bb42
commit 3e47e16
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 0 deletions.
diff --git a/app/app.js b/app/app.js
@@ -3,6 +3,7 @@ const compression = require('compression');
 const config = require('config');
 const cors = require('cors');
 const express = require('express');
+const helmet = require('helmet');
 
 const { name: appName, version: appVersion } = require('./package.json');
 const { AuthMode, DEFAULTCORS } = require('./src/components/constants');
@@ -33,6 +34,18 @@ const app = express();
 app.use(compression());
 app.use(cors(DEFAULTCORS));
 app.use(express.urlencoded({ extended: true }));
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        'default-src': [
+          "'self'", // eslint-disable-line
+          new URL(config.get('keycloak.serverUrl')).origin
+        ]
+      }
+    }
+  })
+);
 
 // Skip if running tests
 if (process.env.NODE_ENV !== 'test') {

diff --git a/app/package-lock.json b/app/package-lock.json
diff --git a/app/package.json b/app/package.json
@@ -41,6 +41,7 @@
     "express": "^4.18.2",
     "express-basic-auth": "^1.2.1",
     "express-winston": "^4.2.0",
+    "helmet": "^7.1.0",
     "joi": "^17.11.0",
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",