csp-dev

Spec compliant content security policy builder and parser. 🚨

Install

npm i -D csp-dev

Use

Build Policy

const ContentSecurityPolicy = require('csp-dev')

const builder = new ContentSecurityPolicy()
builder.newDirective('script-src', ['self', 'unsafe-inline', 'nonce-2726c7f26c', '*.test.com'])
builder.newDirective('default-src', 'self')
builder.newDirective('style-src', 'data:')

// or by loading an object

const builder2 = new ContentSecurityPolicy()
builder2.load({
  'default-src': ['self'],
  'script-src': [
    'self', 'unsafe-inline', 'nonce-2726c7f26c', '*.test.com'
  ],
  'style-src': ['data:']
})

Parse Policy Data

const ContentSecurityPolicy = require('csp-dev')

const data = `
default-src 'self';
script-src 'self' 'unsafe-inline' 'nonce-2726c7f26c' *.test.com;
style-src data:
`
const parser = new ContentSecurityPolicy(data)

parser.valid() // true|false

Share

Share data as json, spec compliant csp string or html meta tag:

parser.share('json')
`
{
  'default-src': ['self'],
  'script-src': [
    'self', 'unsafe-inline', 'nonce-2726c7f26c', '*.test.com'
  ],
  'style-src': ['data:']
}
`

parser.share('string')
`
default-src 'self'; script-src 'self' 'unsafe-inline' 'nonce-2726c7f26c' *.test.com; style-src data:
`

parser.share('html')
`
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'nonce-2726c7f26c' *.test.com; style-src data:">
`

Tests

See spec folder for tests. I'll expand the test suite as I update the library. You can run tests by npm run test

Notes

The reporting feature of csp hasn't been implemented. I haven't get fully understand but I think there is no accepted standart to it for now.

Thanks for watching 🐬

Version management of this repository done by releaser 🚀