Add option to disable non-standard CSP headers

[helmetjs]

Add option to disable non-standard CSP headers

[EvanHahn]

I agree. I've also thought about a version of this module that does no browser sniffing; is that something you'd want?

[kara-ryli]

I'm a fan of the entire helmet suite, so I'd be uninterested in a second library. I would, however be happy to send a PR if the maintainers would consider it.

[kara-ryli]

The API change I would make would be a new option, setLegacyHeaders which supports three values:

• "auto" - the current default behavior
• any other truthy value - equivalent of setAllHeaders: true
• any defined falsey value - only sets the standard header

The default value would be derived from the setAllHeaders config for backwards compatibility, and setAllHeaders would become deprecated.

[EvanHahn]

Ah, sorry—I didn't mean to suggest I'd make another library.

What about this?

// Current default behavior (these are all equivalent)
csp({})
csp({ setLegacyHeaders: true })
csp({ setAllHeaders: false })

// Always set all headers
csp({ setAllHeaders: true })

// Don't set legacy headers; do no browser sniffing
csp({ setLegacyHeaders: false })

// This throws an error
csp({
  setAllHeaders: true,
  setLegacyHeaders: false
})

[kara-ryli]

Looks good to me.

[EvanHahn]

Would you be interested in making a pull request?

[kara-ryli]

Sure, I'll give it a shot.

[EvanHahn]

I took bits and pieces of what you did, committed it with you as the author, and added you as a contributor in the package.json. I decided to go with an API of browserSniff: false which eschews all useragent sniffing.

This is released in [email protected] and [email protected].

Thanks for your help!

[EvanHahn]

@ry7n I'm making a new website for Helmet.js and I want to credit everyone who's contributed. Do you have a name and/or website you'd like me to use to credit you?

[RCanine]

Thanks! You can use the name and URL on my Github profile.

[EvanHahn]

Added you to the list! Stay tuned for the new Helmet documentation website.