Merge pull request #86 from gpinto67/gpinto/Cross-Origin-Headers

feat(issue#85): add support for cross-origin headers

Author: venables

koa-helmet.d.ts

@@ -8,7 +8,7 @@
 import helmet from 'helmet';
 import { Middleware, Context } from 'koa';
 
-type HelmetOptions = Required<Parameters<typeof helmet>>[0];
+type HelmetOptions = helmet.HelmetOptions;
 
 declare namespace koaHelmet {
     type KoaHelmetContentSecurityPolicyDirectiveFunction = (req?: Context["req"], res?: Context["res"]) => string;
@@ -50,6 +50,9 @@ declare namespace koaHelmet {
     interface KoaHelmet {
         (options?: HelmetOptions): Middleware;
         contentSecurityPolicy(options?: KoaHelmetContentSecurityPolicyConfiguration): Middleware;
+        crossOriginEmbedderPolicy(options?: HelmetOptions['crossOriginEmbedderPolicy']): Middleware;
+        crossOriginOpenerPolicy(options?: HelmetOptions['crossOriginOpenerPolicy']): Middleware;
+        crossOriginResourcePolicy(options?: HelmetOptions['crossOriginResourcePolicy']): Middleware;
         dnsPrefetchControl(options?: HelmetOptions['dnsPrefetchControl']): Middleware;
         expectCt(options?: HelmetOptions['expectCt']): Middleware;
         frameguard(options?: HelmetOptions['frameguard']): Middleware;

test/koa-helmet.spec.js

@@ -19,6 +19,15 @@ test('it works with the default helmet call', t => {
       // contentSecurityPolicy
       .expect('Content-Security-Policy', 'default-src \'self\';base-uri \'self\';font-src \'self\' https: data:;form-action \'self\';frame-ancestors \'self\';img-src \'self\' data:;object-src \'none\';script-src \'self\';script-src-attr \'none\';style-src \'self\' https: \'unsafe-inline\';upgrade-insecure-requests')
 
+      // crossOriginEmbedderPolicy
+      .expect('Cross-Origin-Embedder-Policy', 'require-corp')
+
+      // crossOriginOpenerPolicy
+      .expect('Cross-Origin-Opener-Policy', 'same-origin')
+
+      // crossOriginResourcePolicy
+      .expect('Cross-Origin-Resource-Policy', 'same-origin')
+      
       // dnsPrefetchControl
       .expect('X-DNS-Prefetch-Control', 'off')
 
@@ -59,6 +68,9 @@ test('it sets individual headers properly', t => {
     })
   );
   app.use(helmet.contentSecurityPolicy());
+  app.use(helmet.crossOriginEmbedderPolicy());
+  app.use(helmet.crossOriginOpenerPolicy());
+  app.use(helmet.crossOriginResourcePolicy());
   app.use(
     helmet.dnsPrefetchControl({
       allow: false,
@@ -82,6 +94,15 @@ test('it sets individual headers properly', t => {
       // contentSecurityPolicy
       .expect('Content-Security-Policy', 'default-src \'self\';base-uri \'self\';font-src \'self\' https: data:;form-action \'self\';frame-ancestors \'self\';img-src \'self\' data:;object-src \'none\';script-src \'self\';script-src-attr \'none\';style-src \'self\' https: \'unsafe-inline\';upgrade-insecure-requests')
 
+      // crossOriginEmbedderPolicy
+      .expect('Cross-Origin-Embedder-Policy', 'require-corp')
+
+      // crossOriginOpenerPolicy
+      .expect('Cross-Origin-Opener-Policy', 'same-origin')
+
+      // crossOriginResourcePolicy
+      .expect('Cross-Origin-Resource-Policy', 'same-origin')
+
       // dnsPrefetchControl
       .expect('X-DNS-Prefetch-Control', 'off')