fdawgs/yh-sider-obfuscation-service

Yeovil Hospital's SIDeR contextual link obfuscation service

Well Bonjour!

🏥 I work for a clinical software developer working with the NHS.

Previously worked within the NHS over six years across Taunton and Somerset NHSFT, Yeovil District Hospital NHSFT, and Somerset NHSFT, as an information analyst and then an interface developer.

Have a nack for automating myself out of employment.

Contact

Stats

yh-sider-obfuscation-service's Issues

Increase test coverage to 100%

Use CSP nonces or hashes to allow scripts individually

Prerequisites

• I have written a descriptive title
• I have searched existing feature requests to ensure it has not already been proposed
• I agree to follow the Code of Conduct that this project adheres to

Description

Flagged by Lighthouse, nonces or hashes should be used in script-src and style-src directives of the Content-Security-Policy response header.

'unsafe-inline' is currently used in the CSP response header of the /docs route, which allows the execution of unsafe in-page scripts and event handlers:
https://github.com/Fdawgs/ydh-sider-obfuscation-service/blob/b91ee035fe2d8b71d1ea7097c462529f557cda21/src/server.js#L127-L128

The @fastify/helmet plugin provides an option to generate nonces and it should be possible to pass these values to the redoc object via the nonce option.

Add ability to protect service by requiring an API token being passed via query string

Prerequisites

• I have written a descriptive title

• I have searched existing feature requests to ensure it has not already been proposed

• I agree to follow the Code of Conduct that this project adheres to

Description

As title states.
Should further restrict access to service.

Clinical systems in use at YDH do not allow modification of request HTTP headers in contextual links, only the query string. So cannot use bearer token auth from header.

Upgrade schemas to support OpenAPI spec v3.0.0

Move pino-pretty config out of 'start:dev' script and into config.js

Describe the bug

Nodemon doesn't play well with it, on Windows at least

Add TypoCI config file

Update branding to Somerset NHSFT

Yeovil District Hospital NHS Foundation Trust is due to merge with Somerset NHS Foundation Trust on 2023-04-01, and YDH NHSFT will cease to exist as an organisation.

• Replace ydh.nhs.uk email domain with somersetft.nhs.uk
• YDH NHSFT -> YDH
• Add Somerset FT to license
• Update background color in config
• Update static assets to use SFT logos
• Use SFT logo in readme
• Use SFT logo in social preview image
• Update API doc page example image

Reduce response header bloat for non-HTML/XML files

Prerequisites

• I have written a descriptive title

• I have searched existing feature requests to ensure it has not already been proposed

• I agree to follow the Code of Conduct that this project adheres to

Description

Some HTTP headers do not make sense to be sent for non-HTML/XML resources, as sending them does not provide any value to users and contributes to header bloat.

Examples include content-security-policy and x-xss-protection for the PNG images on the doc pages and for the JSON responses in the API itself.

The only CSP directive that may be of use is frame-ancestors 'none' to stop responses from being wrapped in iframes.

Add serialisation support to OpenAPI spec route

Prerequisites

• I have written a descriptive title

• I have searched existing feature requests to ensure it has not already been proposed

• I agree to follow the Code of Conduct that this project adheres to

Description

Also support application/xml

OpenAPI spec does not provide multiple content-types

Prerequisites

• I have written a descriptive issue title

• I have searched existing issues to ensure it has not already been reported

• I agree to follow the Code of Conduct that this project adheres to

API/app/plugin version

8.0.0

Node.js version

16.14.2

Operating system

Windows

Operating system version (i.e. 20.04, 11.3, 10)

10

Description

See fastify/fastify-swagger#117

Steps to Reproduce

Navigate to /docs/openapi

Expected Behaviour

No response

Support security.txt

Prerequisites

• I have written a descriptive title

• I have searched existing feature requests to ensure it has not already been proposed

• I agree to follow the Code of Conduct that this project adheres to

Description

See https://securitytxt.org/

See example: https://vdp.cabinetoffice.gov.uk/.well-known/security.txt

Continue to redirect URL if Keycloak auth fails

Prerequisites

• I have written a descriptive title

• I have searched existing feature requests to ensure it has not already been proposed

• I agree to follow the Code of Conduct that this project adheres to

Description

User should be able to continue to redirect URL and manually login, but the keycloak params will be removed from the URL.

Add rate-limiting

Is your feature request related to a problem? Please describe.
Stop staff from hammering the button in the PAS, and flooding keycloak and such with requests

Remove Swagger UI Route

Route is far too buggy, and shows up in security audits as being THE weak point too often.

Will replace with a pure OpenAPI spec route instead.

Migrate from Axios to Undici/Fetch

Prerequisites

• I have written a descriptive title

• I have searched existing feature requests to ensure it has not already been proposed

• I agree to follow the Code of Conduct that this project adheres to

Description

Revisit once Node 20 is released and Undici is a bit more stable.

Review potentially unsafe regex

Regex to validate practitioner query string param is potentially unsafe:

https://github.com/Fdawgs/ydh-sider-obfuscation-service/blob/db9bab175a21d472e6816daee09864a7fc64efc2/src/routes/redirect/schema.js#L56

Move logging to Pino transport

Moving the logging to a worker thread would reduce blocking of main thread.

See following for supporting info:

• https://getpino.io/#/docs/transports
• rogerc/file-stream-rotator#99
• https://www.digitalocean.com/community/tutorials/how-to-use-multithreading-in-node-js
• pinojs/pino#1323