# All files / server/plugins/security index.js

100% Statements 9/9
62.5% Branches 5/8
100% Functions 3/3
100% Lines 9/9

Press n or j to go to the next uncovered block, b, p or k for the previous block.

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    6427x
    27x
    27x

    27x

    79x

    79x
    79x
    79x

    79x

     const modern = require('../../src/modern');
    const csurf = require('csurf');
    const helmet = require('helmet');

    module.exports = {
      name: 'security',
      options: {
        csrf: {
          env: 'SECURITY_CSRF',
          default: {},
          type: Object
        },
        contentSecurityPolicy: {
          env: 'SECURITY_CONTENTSECURITYPOLICY'
        },
        expectCt: {
          env: 'SECURITY_EXPECTCT'
        },
        dnsPrefetchControl: {
          env: 'SECURITY_DNSPREFETCHCONTROL'
        },
        frameguard: {
          env: 'SECURITY_FRAMEGUARD'
        },
        hidePoweredBy: {
          env: 'SECURITY_HIDEPOWEREDBY'
        },
        hpkp: {
          env: 'SECURITY_HPKP'
        },
        hsts: {
          env: 'SECURITY_HSTS'
        },
        ieNoOpen: {
          env: 'SECURITY_IENOOPEN'
        },
        noCache: {
          env: 'SECURITY_NOCACHE'
        },
        noSniff: {
          env: 'SECURITY_NOSNIFF'
        },
        referrerPolicy: {
          env: 'SECURITY_REFERRERPOLICY'
        },
        xssFilter: {
          env: 'SECURITY_XSSFILTER'
        }
      },
      before: [
        ctx => ctx.options.security && ctx.options.security.csrf
          ? modern(csurf(ctx.options.security.csrf))(ctx)
          : false,
        ctx => {
          // Set the csrf for render(): https://expressjs.com/en/api.html#res.locals
          Eif (ctx.req.csrfToken) {
            ctx.csrf = ctx.req.csrfToken();
            ctx.res.locals.csrf = ctx.csrf;
          }
        },
        ctx => ctx.options.security ? modern(helmet(ctx.options.security))(ctx) : false
      ]
    };