frux/csp-header

csp-header moved to monorepo https://github.com/frux/csp

csp-header's Issues

Helper for nonce

export const generateNonce = (): string => randomBytes(16).toString('base64');

Referer policies don't work

Can you please show an example how to add referer policies to the CSP? I don't get it to work.

// referer values
export const NO_REFERER = "'no-referer'";
export const NONE_WHEN_DOWNGRADE = "'none-when-downgrade'";
export const ORIGIN = "'origin'";
export const ORIGIN_WHEN_CROSS_ORIGIN = "'origin-when-cross-origin'";
export const UNSAFE_URL = "'unsafe-url'";

Thanks

Sha numbers not recognized

Hello,

When using this library, I found that cps.INLINE constant would work, but 'unsafe-inline' would not. I mention this because when trying to use 'sha256-ASTASFGA23SDGA23' as a string constant, this also does not work. Obviously we can't have const for all sha #.

Was wondering if there was a quick fix for this?
Thanks

Please support the script-src-elem and style-src-elem policies

Can you please extend the library to support the (newer?) *-elem policies?
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

Thanks

Directives are joined with "," instead of " " in 2.0

In 2.0 The following doesn't work anymore:

{
  directives: {
  // ...
  "connect-src": ["'self'", oidcAuthorityUrl, "https://translation.googleapis.com"],
  // ...
  }
}

because the rules are string-joined with a ",".

.. instead I have to use "connect-src": [`'self' ${oidcAuthority} https://translation.googleapis.com`], (note the spaces).

Is this change on purpose?