@side/fortifyjs

A platform-agnostic library for generating security headers for your web application.

Getting Started

Modern web applications don't just need a helmet; they need a fortress. FortifyJS is just that, the walls to gate client and server-side requests in a world where attackers can manipulate the browser in many ways to break into your web application and steal information of trade secrets.

While helmet.js is useful for express applications, in a world of alternatives to express popping up and different ways of writing JavaScript applications on the rise, there needs to be an alternative that abstracts the production of valid security headers out of our modern applications. FortifyJS exists in this niche. FortifyJS is solely responsible for providing a representation that is useful in setting headers in consumer applications. FortifyJS takes control of the headers; you take over and implement them in your application.

FortifyJS also differs in that it seeks to provide a comprehensive set of security headers to form a default posture for any application.

Installation

Install through your package manager within an existing project:

yarn add @side/fortifyjs

How-to

FortifyJS exports one function: fortifyHeaders. FortifyJS takes an object literal with properties that match each supported security header. This function returns an object mapping ths string header name (e.g. X-Content-Type-Options) to a value (e.g. nosniff).

The current default configuration can be expressed like this:

import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';

const headers = fortifyHeaders({
  xContentTypeOptions: {
    nosniff: true,
  },
  contentSecurityPolicy: {
    defaultSrc: ["'self'"],
    baseUri: ["'self'"],
    fontSrc: ["'self'", 'https:', 'data:'],
    frameAncestors: ["'self'"],
    imgSrc: ["'self'", "'data:'"],
    objectSrc: ["'none'"],
    scriptSrc: ["'self'"],
    scriptSrcAttr: ["'none'"],
    styleSrc: ["'self'", "'https:'", "'unsafe-inline'"],
    upgradeInsecureRequests: true,
  },
  crossOriginEmbedderPolicy: {
    requireCorp: true,
  },
  crossOriginOpenerPolicy: {
    sameOrigin: true,
  },
  crossOriginResourcePolicy: {
    sameOrigin: true,
  },
  expectCt: {
    maxAge: 0,
  },
  originAgentCluster: {
    enable: true,
  },
  referrerPolicy: {
    noReferrer: true,
  },
  strictTransportSecurity: {
    maxAge: 31536000,
  },
  xContentTypeOptions: {
    noSniff: true,
  },
  xDnsPrefetchControl: {
    off: true,
  },
  xDownloadOptions: {
    noopen: true,
  },
  xFrameOptions: {
    sameOrigin: true,
  },
  xPermittedCrossDomainPolicies: {
    none: true,
  },
});

/** @type {FortifySettings} */
console.log(headers);
/*
 * {
      'Content-Security-Policy':
        "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests",
      'Cross-Origin-Embedder-Policy': 'require-corp',
      'Cross-Origin-Opener-Policy': 'same-origin',
      'Cross-Origin-Resource-Policy': 'same-origin',
      'Expect-Ct': 'max-age=0',
      'Origin-Agent-Cluster': '?1',
      'Referrer-Policy': 'no-referrer',
      'Strict-Transport-Security': 'max-age=15552000',
      'X-Content-Type-Options': 'nosniff',
      'X-Dns-Prefetch-Control': 'off',
      'X-Download-Options': 'noopen',
      'X-Frame-Options': 'SAMEORIGIN',
      'X-Permitted-Cross-Domain-Policies': 'none',
    }
 */

You can choose to use these defaults by setting the fortify header to an empty object. This can be done globally:

import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';

const headers = fortifyHeaders();

/** @type {FortifySettings} */
console.log(headers); // same as above

Or, you can choose to pull in individual header default postures:

import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';

const headers = fortifyHeaders({
  contentSecurityPolicy: {},
});

/** @type {FortifySettings} */
console.log(headers); // same as above
/*
 * {
      'Content-Security-Policy':
        "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests",
    }
 */

If you want to specify a custom header value for one, like Content-Security-Policy, but also want to include all of the default headers, then you can use the second parameter to fortifyHeaders to tell the header generation that you want to include the rest of the available headers:

import { fortifyHeaders, FortifySettings } from '@side/fortifyjs';

const headers = fortifyHeaders(
  {
    contentSecurityPolicy: {
      defaultSrc: ["'self'", '*.somedomain.com'],
    },
  },
  { useDefaults: true },
);

/** @type {FortifySettings} */
console.log(headers); // same as above
/*
 * {
      'Content-Security-Policy': "default-src 'self' *.somedomain.com",
      'Cross-Origin-Embedder-Policy': 'require-corp',
      'Cross-Origin-Opener-Policy': 'same-origin',
      'Cross-Origin-Resource-Policy': 'same-origin',
      'Expect-Ct': 'max-age=0',
      'Origin-Agent-Cluster': '?1',
      'Referrer-Policy': 'no-referrer',
      'Strict-Transport-Security': 'max-age=15552000',
      'X-Content-Type-Options': 'nosniff',
      'X-Dns-Prefetch-Control': 'off',
      'X-Download-Options': 'noopen',
      'X-Frame-Options': 'SAMEORIGIN',
      'X-Permitted-Cross-Domain-Policies': 'none',
    }
 */

You can then use this object to integrate within the platform of your choice: next, fastify, etc.

Header Inclusion Strategy

The strategy for this problem is building a lib that can be consumed by packages that integrate with these different providers: next, fastify, etc.

Since this library is specifically for delivering the relevant headers to secure modern web applications, it not contain information about X-Powered-By. This header is typically removed completely. FortifyJS only provides ones that ought to be included, not excluded. This should be handled at the consumer-level in whichever platform you're integrating the security headers into.

Supported Headers

Header Name	Default Value	Details
Content-Security-Policy	default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests	Link
Cross-Origin-Embedder-Policy	require-corp	Link
Cross-Origin-Opener-Policy	same-origin	Link
Cross-Origin-Resource-Policy	same-origin	Link
Expect-Ct	max-age=0	Link
Origin-Agent-Cluster	?1	Link
Referrer-Policy	no-referrer	Link
Strict-Transport-Security	max-age=15552000	Link
X-Content-Type-Options	nosniff	Link
X-Dns-Prefetch-Control	off	Link
X-Download-Options	noopen	Link
X-Frame-Options	SAMEORIGIN	Link
X-Permitted-Cross-Domain-Policies	none	Link

Contributing Policy

The development team at Side is currently investigating the best expression of Codes of Conduct and Contributing Guidelines to fit our culture and values. FortifyJS is a Free and Open Source software solution that is licensed under MIT. If you desire to contribute to extend the functionality or address an issue, please maintain professional communication practices. That alone goes a long way toward effective collaboration and benefiting the community at large!