Content Security Policy

1import { csp } from '@morojs/moro';
2
3// Basic CSP configuration
4app.use(csp({
5  directives: {
6    defaultSrc: ["'self'"],
7    scriptSrc: ["'self'", "'nonce-{NONCE}'"],
8    styleSrc: ["'self'", "'nonce-{NONCE}'"],
9    imgSrc: ["'self'", 'data:', 'https:']
10  },
11  reportOnly: false,
12  reportUri: '/api/csp-violations'
13}));
14
15// Access nonce in templates
16app.get('/page', (req, res) => {
17  const nonce = req.cspNonce;
18  return `<script nonce="${nonce}">alert('Safe');</script>`;
19});

1import { csp } from '@morojs/moro';
2
3// Advanced CSP configuration with nonce support
4app.use(csp({
5  directives: {
6    defaultSrc: ["'self'"],
7    scriptSrc: [
8      "'self'",
9      "'nonce-{NONCE}'", // Nonce for inline scripts
10      "'sha256-...'", // Hash for specific scripts
11      'https://cdn.example.com'
12    ],
13    styleSrc: [
14      "'self'",
15      "'nonce-{NONCE}'", // Nonce for inline styles
16      "'unsafe-inline'", // Allow inline styles (less secure)
17      'https://fonts.googleapis.com'
18    ],
19    imgSrc: ["'self'", 'data:', 'https:'],
20    connectSrc: ["'self'", 'https://api.example.com'],
21    fontSrc: ["'self'", 'https://fonts.gstatic.com'],
22    objectSrc: ["'none'"], // Block plugins
23    mediaSrc: ["'self'"],
24    frameSrc: ["'none'"], // Block iframes
25    baseUri: ["'self'"],
26    formAction: ["'self'"],
27    upgradeInsecureRequests: true
28  },
29  nonce: true, // Enable nonce generation
30  reportOnly: false, // Enforce policy (not just report)
31  reportUri: '/api/csp-violations'
32}));
33
34// Access nonce in route handlers
35app.get('/dashboard', (req, res) => {
36  const nonce = req.cspNonce;
37  
38  return {
39    html: `
40      <script nonce="${nonce}">
41        // This script will be allowed
42        console.log('Safe script');
43      </script>
44      <style nonce="${nonce}">
45        /* This style will be allowed */
46        body { margin: 0; }
47      </style>
48    `
49  };
50});