You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -34,16 +34,37 @@ These headers will *help* prevent cross-site scripting attacks, SSL downgrade at
34
34
35
35
# Usage
36
36
37
-
To use Vapor Security Headers, just register the middleware with your services and add it to your `MiddlewareConfig`. Vapor Security Headers makes this easy to do with a `build` function on the factory. In `configure.swift` add:
37
+
## Add the package
38
+
39
+
Add the package as a dependency in your `Package.swift` manifest:
To use Vapor Security Headers, you need to add the middleware to your `Application`'s `Middlewares`. Vapor Security Headers makes this easy to do with a `build` function on the factory. **Note:** if you want security headers added to error reponses (recommended), you need to initialise the `Middlewares` from fresh and add the middleware in _after_ the `SecuriyHeaders`. In `configure.swift` add:
38
60
39
61
```swift
40
62
let securityHeadersFactory =SecurityHeadersFactory()
The default factory will add default values to your site for Content-Security-Policy, X-XSS-Protection, X-Frame-Options and X-Content-Type-Options.
@@ -55,7 +76,7 @@ x-frame-options: DENY
55
76
x-xss-protection: 1; mode=block
56
77
```
57
78
58
-
***Note:*** You should ensure you set the security headers as the last middleware in your `MiddlewareConfig` (i.e., the first middleware to be applied to responses) to make sure the headers get added to all responses.
79
+
***Note:*** You should ensure you set the security headers as the first middleware in your `Middlewares` (i.e., the first middleware to be applied to responses) to make sure the headers get added to all responses.
59
80
60
81
If you want to add your own values, it is easy to do using the factory. For instance, to add a content security policy configuration, just do:
Each different header has its own configuration and options, details of which can be found below.
88
100
89
101
You can test your site by visiting the awesome [Security Headers](https://securityheaders.io) (no affiliation) website.
@@ -94,6 +106,7 @@ If you are running an API you can choose a default configuration for that by cre
94
106
95
107
```swift
96
108
let securityHeaders = SecurityHeadersFactory.api()
109
+
application.middleware.use(securityHeaders)
97
110
```
98
111
99
112
```http
@@ -103,19 +116,11 @@ x-frame-options: DENY
103
116
x-xss-protection: 1; mode=block
104
117
```
105
118
106
-
## Manual Initialization
107
-
108
-
You can also build the middleware manually like so:
109
-
110
-
```swift
111
-
let securityHeadersMiddleware =SecurityHeadersFactory().build()
112
-
```
113
-
114
119
# Server Configuration
115
120
116
121
## Vapor
117
122
118
-
If you are running Vapor on it's own (i.e. not as a CGI application or behind and reverse proxy) then you do not need to do anything more to get it running!
123
+
If you are running Vapor on it's own (i.e. not as a CGI application or behind a reverse proxy) then you do not need to do anything more to get it running!
119
124
120
125
## Nginx, Apache and 3rd Party Services
121
126
@@ -276,7 +281,7 @@ Check out [https://report-uri.io/](https://report-uri.io/) for a free tool to se
276
281
277
282
### Page Specific CSP
278
283
279
-
Vapor Security Headers also supports setting the CSP on a route or request basis. If the middleware has been added to the `MiddlewareConfig`, you can override the CSP for a request. This allows you to have a strict default CSP, but allow content from extra sources when required, such as only allowing the Javascript for blog comments on the blog page. Create a separate `ContentSecurityPolicyConfiguration` and then add it to the request. For example, inside a route handler, you could do:
284
+
Vapor Security Headers also supports setting the CSP on a route or request basis. If the middleware has been added to the `Middlewares`, you can override the CSP for a request. This allows you to have a strict default CSP, but allow content from extra sources when required, such as only allowing the Javascript for blog comments on the blog page. Create a separate `ContentSecurityPolicyConfiguration` and then add it to the request. For example, inside a route handler, you could do:
You must also enable the `CSPRequestConfiguration` service for this to work. In `configure.swift` add:
295
-
296
-
```swift
297
-
services.register { _in
298
-
returnCSPRequestConfiguration()
299
-
}
300
-
```
301
-
302
299
## Content-Security-Policy-Report-Only
303
300
304
301
Content-Security-Policy-Report-Only works in exactly the same way as Content-Security-Policy except that any violations will not block content, but they will be reported back to you. This is extremely useful for testing a CSP before rolling it out over your site. You can run both side by side - so for example have a fairly simply policy under Content-Security-Policy but test a more restrictive policy over Content-Security-Policy-Report-Only. The great thing about this is that your users do all your testing for you!
The Server header is usually hidden from responses in order to not give away what type of server you are running and what version you are using. This is to stop attackers from scanning your site and using known vulnerabilities against it easily. By default Vapor does not show the server header in responses for this reason.
445
442
446
-
However, it can be fun to add in a custom server configuration for a bit of personalization, such as your website name, or company name (look at Github's response) and the `ServerConfiguraiton`is to allow this. So, for example, if I wanted my `Server` header to be `brokenhands.io`, I would configure it like:
443
+
However, it can be fun to add in a custom server configuration for a bit of personalization, such as your website name, or company name (look at Github's response) and the `ServerConfiguraiton`allows this. So, for example, if I wanted my `Server` header to be `brokenhands.io`, I would configure it like:
447
444
448
445
```swift
449
446
let serverConfig =ServerConfiguration(value: "brokenhands.io")
0 commit comments