Project rename
This commit is contained in:
+2
@@ -0,0 +1,2 @@
|
||||
test
|
||||
.travis.yml
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2014-2016 Evan Hahn, Adam Baldwin
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
+29
@@ -0,0 +1,29 @@
|
||||
Frameguard
|
||||
==========
|
||||
[](https://travis-ci.org/helmetjs/frameguard)
|
||||
[](http://standardjs.com/)
|
||||
|
||||
[_Looking for a changelog?_](https://github.com/helmetjs/helmet/blob/master/HISTORY.md)
|
||||
|
||||
The `X-Frame-Options` HTTP header restricts who can put your site in a frame which can help mitigate things like [clickjacking attacks](https://en.wikipedia.org/wiki/Clickjacking). It has three modes: `DENY`, `SAMEORIGIN`, and `ALLOW-FROM`, defaulting to `SAMEORIGIN`. If your app does not need to be framed (and most don't) you can use `DENY`. If your site can be in frames from the same origin, you can set it to `SAMEORIGIN`. If you want to allow it from a specific URL, you can allow that with `ALLOW-FROM` and a URL.
|
||||
|
||||
Usage:
|
||||
|
||||
```javascript
|
||||
var frameguard = require('frameguard')
|
||||
|
||||
// Don't allow me to be in ANY frames:
|
||||
app.use(frameguard({ action: 'deny' }))
|
||||
|
||||
// Only let me be framed by people of the same origin:
|
||||
app.use(frameguard({ action: 'sameorigin' }))
|
||||
app.use(frameguard()) // defaults to sameorigin
|
||||
|
||||
// Allow from a specific host:
|
||||
app.use(frameguard({
|
||||
action: 'allow-from',
|
||||
domain: 'http://example.com'
|
||||
}))
|
||||
```
|
||||
|
||||
This has pretty good (but not 100%) browser support: IE8+, Opera 10.50+, Safari 4+, Chrome 4.1+, and Firefox 3.6.9+. The `ALLOW-FROM` header option is [not supported in most browsers](https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options#Browser_compatibility). Those browsers will ignore the entire header, [and the frame *will* be displayed](https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#Limitations_2).
|
||||
+40
@@ -0,0 +1,40 @@
|
||||
var isString = require('./lib/isstring')
|
||||
|
||||
module.exports = function frameguard (options) {
|
||||
options = options || {}
|
||||
|
||||
var domain = options.domain
|
||||
var action = options.action
|
||||
|
||||
var directive
|
||||
if (action === undefined) {
|
||||
directive = 'SAMEORIGIN'
|
||||
} else if (isString(action)) {
|
||||
directive = action.toUpperCase()
|
||||
}
|
||||
|
||||
if (directive === 'ALLOWFROM') {
|
||||
directive = 'ALLOW-FROM'
|
||||
} else if (directive === 'SAME-ORIGIN') {
|
||||
directive = 'SAMEORIGIN'
|
||||
}
|
||||
|
||||
if (['DENY', 'ALLOW-FROM', 'SAMEORIGIN'].indexOf(directive) === -1) {
|
||||
throw new Error('action must be undefined, "DENY", "ALLOW-FROM", or "SAMEORIGIN".')
|
||||
}
|
||||
|
||||
if (directive === 'ALLOW-FROM') {
|
||||
if (!isString(domain)) {
|
||||
throw new Error('ALLOW-FROM action requires a domain parameter.')
|
||||
}
|
||||
if (!domain.length) {
|
||||
throw new Error('domain parameter must not be empty.')
|
||||
}
|
||||
directive = 'ALLOW-FROM ' + domain
|
||||
}
|
||||
|
||||
return function frameguard (req, res, next) {
|
||||
res.setHeader('X-Frame-Options', directive)
|
||||
next()
|
||||
}
|
||||
}
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
module.exports = function (val) {
|
||||
return typeof val === 'string' || val instanceof String
|
||||
}
|
||||
+113
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"_args": [
|
||||
[
|
||||
{
|
||||
"raw": "frameguard@3.0.0",
|
||||
"scope": null,
|
||||
"escapedName": "frameguard",
|
||||
"name": "frameguard",
|
||||
"rawSpec": "3.0.0",
|
||||
"spec": "3.0.0",
|
||||
"type": "version"
|
||||
},
|
||||
"/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet"
|
||||
]
|
||||
],
|
||||
"_from": "frameguard@3.0.0",
|
||||
"_id": "frameguard@3.0.0",
|
||||
"_inCache": true,
|
||||
"_location": "/frameguard",
|
||||
"_nodeVersion": "7.0.0",
|
||||
"_npmOperationalInternal": {
|
||||
"host": "packages-12-west.internal.npmjs.com",
|
||||
"tmp": "tmp/frameguard-3.0.0.tgz_1477677663567_0.5708280894905329"
|
||||
},
|
||||
"_npmUser": {
|
||||
"name": "evanhahn",
|
||||
"email": "me@evanhahn.com"
|
||||
},
|
||||
"_npmVersion": "4.0.1",
|
||||
"_phantomChildren": {},
|
||||
"_requested": {
|
||||
"raw": "frameguard@3.0.0",
|
||||
"scope": null,
|
||||
"escapedName": "frameguard",
|
||||
"name": "frameguard",
|
||||
"rawSpec": "3.0.0",
|
||||
"spec": "3.0.0",
|
||||
"type": "version"
|
||||
},
|
||||
"_requiredBy": [
|
||||
"/helmet"
|
||||
],
|
||||
"_resolved": "https://registry.npmjs.org/frameguard/-/frameguard-3.0.0.tgz",
|
||||
"_shasum": "7bcad469ee7b96e91d12ceb3959c78235a9272e9",
|
||||
"_shrinkwrap": null,
|
||||
"_spec": "frameguard@3.0.0",
|
||||
"_where": "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet",
|
||||
"author": {
|
||||
"name": "Adam Baldwin",
|
||||
"email": "baldwin@andyet.net",
|
||||
"url": "http://andyet.net/team/baldwin"
|
||||
},
|
||||
"bugs": {
|
||||
"url": "https://github.com/helmetjs/frameguard/issues"
|
||||
},
|
||||
"contributors": [
|
||||
{
|
||||
"name": "Evan Hahn",
|
||||
"email": "me@evanhahn.com",
|
||||
"url": "http://evanhahn.com"
|
||||
}
|
||||
],
|
||||
"dependencies": {},
|
||||
"description": "Middleware to set X-Frame-Options headers",
|
||||
"devDependencies": {
|
||||
"connect": "^3.4.1",
|
||||
"mocha": "^2.4.5",
|
||||
"standard": "^6.0.7",
|
||||
"supertest": "^1.2.0"
|
||||
},
|
||||
"directories": {},
|
||||
"dist": {
|
||||
"shasum": "7bcad469ee7b96e91d12ceb3959c78235a9272e9",
|
||||
"tarball": "https://registry.npmjs.org/frameguard/-/frameguard-3.0.0.tgz"
|
||||
},
|
||||
"gitHead": "9fa6a417df5e6be4a160d5361ec334efccb9d4ab",
|
||||
"homepage": "https://github.com/helmetjs/frameguard#readme",
|
||||
"keywords": [
|
||||
"helmet",
|
||||
"security",
|
||||
"express",
|
||||
"connect",
|
||||
"x-frame-options",
|
||||
"clickjack",
|
||||
"frame"
|
||||
],
|
||||
"license": "MIT",
|
||||
"maintainers": [
|
||||
{
|
||||
"name": "evanhahn",
|
||||
"email": "me@evanhahn.com"
|
||||
}
|
||||
],
|
||||
"name": "frameguard",
|
||||
"optionalDependencies": {},
|
||||
"readme": "ERROR: No README data found!",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git://github.com/helmetjs/frameguard.git"
|
||||
},
|
||||
"scripts": {
|
||||
"pretest": "standard",
|
||||
"test": "mocha"
|
||||
},
|
||||
"standard": {
|
||||
"globals": [
|
||||
"describe",
|
||||
"beforeEach",
|
||||
"it"
|
||||
]
|
||||
},
|
||||
"version": "3.0.0"
|
||||
}
|
||||
Reference in New Issue
Block a user