@lightspeed/express-csp-middleware


Introduction

Express middleware for generating the HTTP Content-Security-Policy header for Lightspeed apps, allowing developers to control resources the user agent is allowed to load for a given page.

Quick Start

1. Install the dependency in your webapp.

``sh
yarn add @lightspeed/express-csp-middleware
`

2. Apply the middleware to your Express server.

`ts
// server.ts
import express from 'express';
import { cspMiddleware } from '@lightspeed/express-csp-middleware';

const app = express();
app.use(cspMiddleware({ env: process.env.NODE_CONFIG_ENV }));
`

3. Script tags from HTML returned from the server must be attributed with the same unique nonce for the given request. For example, in a Next.js app with serverside rendering, apply the nonce as follows:

`tsx
// app/_document.tsx
import React from 'react';
import Document, { Head, Main, NextScript, NextDocumentContext } from 'next/document';

type MyDocumentProps = {
nonce: string;
};

export default class MyDocument extends Document {
static async getInitialProps(ctx: NextDocumentContext) {
const { nonce } = (ctx.res as any).locals;
const initialProps = await Document.getInitialProps(ctx);
return { ...initialProps, nonce };
}

render() {
return (