Project rename

2019-03-24 08:28:57 +01:00
parent 1728e0e6e1
commit 7926230faf
7262 changed files with 0 additions and 0 deletions
@@ -0,0 +1,2 @@
+test
+.travis.yml
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014-2017 Evan Hahn, Adam Baldwin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,53 @@
+HTTP Strict Transport Security middleware
+========================================
+[![Build Status](https://travis-ci.org/helmetjs/hsts.svg?branch=master)](https://travis-ci.org/helmetjs/hsts)
+[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](http://standardjs.com/)
+
+[_Looking for a changelog?_](https://github.com/helmetjs/helmet/blob/master/HISTORY.md)
+
+This middleware adds the `Strict-Transport-Security` header to the response. This tells browsers, "hey, only use HTTPS for the next period of time". ([See the spec](http://tools.ietf.org/html/rfc6797) for more.) Note that the header won't tell users on HTTP to *switch* to HTTPS, it will just tell HTTPS users to stick around. You can enforce HTTPS with the [express-enforces-ssl](https://github.com/aredo/express-enforces-ssl) module.
+
+This will set the Strict Transport Security header, telling browsers to visit by HTTPS for the next 180 days:
+
+```javascript
+var hsts = require('hsts')
+
+app.use(hsts({
+  maxAge: 15552000  // 180 days in seconds
+}))
+// Strict-Transport-Security: max-age: 15552000; includeSubDomains
+```
+
+Note that the max age must be in seconds. *This was different in previous versions of this module!*
+
+The `includeSubDomains` directive is present by default. If this header is set on *example.com*, supported browsers will also use HTTPS on *my-subdomain.example.com*. You can disable this:
+
+```javascript
+app.use(hsts({
+  maxAge: 15552000,
+  includeSubDomains: false
+}))
+```
+
+Chrome lets you submit your site for baked-into-Chrome HSTS by adding `preload` to the header. You can add that with the following code, and then submit your site to the Chrome team at [hstspreload.appspot.com](https://hstspreload.appspot.com/).
+
+```javascript
+app.use(hsts({
+  maxAge: 10886400,        // Must be at least 18 weeks to be approved by Google
+  includeSubDomains: true, // Must be enabled to be approved by Google
+  preload: true
+}))
+```
+
+This header will always be set because [the header is ignored in insecure HTTP](https://tools.ietf.org/html/rfc6797#section-8.1). If you wish to set it conditionally, you can use `setIf`:
+
+```javascript
+app.use(hsts({
+  maxAge: 1234000,
+  setIf: function (req, res) {
+    return req.secure || (req.headers['x-forwarded-proto'] === 'https')
+  }
+}))
+```
+
+This header is [somewhat well-supported by browsers](http://caniuse.com/#feat=stricttransportsecurity).
@@ -0,0 +1,48 @@
+var defaultMaxAge = 180 * 24 * 60 * 60
+
+module.exports = function hsts (options) {
+  options = options || {}
+
+  var maxAge = options.maxAge != null ? options.maxAge : defaultMaxAge
+  var includeSubDomains = (options.includeSubDomains !== false) && (options.includeSubdomains !== false)
+  var setIf = options.hasOwnProperty('setIf') ? options.setIf : alwaysTrue
+
+  if (options.hasOwnProperty('maxage')) {
+    throw new Error('maxage is not a supported property. Did you mean to pass "maxAge" instead of "maxage"?')
+  }
+  if (arguments.length > 1) {
+    throw new Error('HSTS passed the wrong number of arguments.')
+  }
+  if (typeof maxAge !== 'number') {
+    throw new TypeError('HSTS must be passed a numeric maxAge parameter.')
+  }
+  if (maxAge < 0) {
+    throw new RangeError('HSTS maxAge must be nonnegative.')
+  }
+  if (typeof setIf !== 'function') {
+    throw new TypeError('setIf must be a function.')
+  }
+  if (options.hasOwnProperty('includeSubDomains') && options.hasOwnProperty('includeSubdomains')) {
+    throw new Error('includeSubDomains and includeSubdomains cannot both be specified.')
+  }
+
+  var header = 'max-age=' + Math.round(maxAge)
+  if (includeSubDomains) {
+    header += '; includeSubDomains'
+  }
+  if (options.preload) {
+    header += '; preload'
+  }
+
+  return function hsts (req, res, next) {
+    if (setIf(req, res)) {
+      res.setHeader('Strict-Transport-Security', header)
+    }
+
+    next()
+  }
+}
+
+function alwaysTrue () {
+  return true
+}
@@ -0,0 +1,113 @@
+{
+  "_args": [
+    [
+      {
+        "raw": "hsts@2.1.0",
+        "scope": null,
+        "escapedName": "hsts",
+        "name": "hsts",
+        "rawSpec": "2.1.0",
+        "spec": "2.1.0",
+        "type": "version"
+      },
+      "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet"
+    ]
+  ],
+  "_from": "hsts@2.1.0",
+  "_id": "hsts@2.1.0",
+  "_inCache": true,
+  "_location": "/hsts",
+  "_nodeVersion": "8.2.0",
+  "_npmOperationalInternal": {
+    "host": "s3://npm-registry-packages",
+    "tmp": "tmp/hsts-2.1.0.tgz_1500668271867_0.2635917938314378"
+  },
+  "_npmUser": {
+    "name": "evanhahn",
+    "email": "me@evanhahn.com"
+  },
+  "_npmVersion": "5.3.0",
+  "_phantomChildren": {},
+  "_requested": {
+    "raw": "hsts@2.1.0",
+    "scope": null,
+    "escapedName": "hsts",
+    "name": "hsts",
+    "rawSpec": "2.1.0",
+    "spec": "2.1.0",
+    "type": "version"
+  },
+  "_requiredBy": [
+    "/helmet"
+  ],
+  "_resolved": "https://registry.npmjs.org/hsts/-/hsts-2.1.0.tgz",
+  "_shasum": "cbd6c918a2385fee1dd5680bfb2b3a194c0121cc",
+  "_shrinkwrap": null,
+  "_spec": "hsts@2.1.0",
+  "_where": "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet",
+  "author": {
+    "name": "Adam Baldwin",
+    "email": "baldwin@andyet.net",
+    "url": "http://andyet.net/team/baldwin"
+  },
+  "bugs": {
+    "url": "https://github.com/helmetjs/hsts/issues"
+  },
+  "contributors": [
+    {
+      "name": "Evan Hahn",
+      "email": "me@evanhahn.com",
+      "url": "https://evanhahn.com"
+    }
+  ],
+  "dependencies": {},
+  "description": "HTTP Strict Transport Security middleware.",
+  "devDependencies": {
+    "connect": "^3.6.2",
+    "mocha": "^3.4.2",
+    "standard": "^10.0.2",
+    "supertest": "^3.0.0"
+  },
+  "directories": {},
+  "dist": {
+    "integrity": "sha512-zXhh/DqgrTXJ7erTN6Fh5k/xjMhDGXCqdYN3wvxUvGUQvnxcFfUd8E+6vLg/nk3ss1TYMb+DhRl25fYABioTvA==",
+    "shasum": "cbd6c918a2385fee1dd5680bfb2b3a194c0121cc",
+    "tarball": "https://registry.npmjs.org/hsts/-/hsts-2.1.0.tgz"
+  },
+  "gitHead": "e182acea8833e2714572d6f897a7fd0cf924b1a1",
+  "homepage": "https://github.com/helmetjs/hsts#readme",
+  "keywords": [
+    "helmet",
+    "security",
+    "express",
+    "connect",
+    "hsts",
+    "https"
+  ],
+  "license": "MIT",
+  "maintainers": [
+    {
+      "name": "evanhahn",
+      "email": "me@evanhahn.com"
+    }
+  ],
+  "name": "hsts",
+  "optionalDependencies": {},
+  "readme": "ERROR: No README data found!",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/helmetjs/hsts.git"
+  },
+  "scripts": {
+    "pretest": "standard",
+    "test": "mocha"
+  },
+  "standard": {
+    "globals": [
+      "describe",
+      "beforeEach",
+      "it"
+    ]
+  },
+  "version": "2.1.0"
+}