Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore/1.0.0 rc.1 #212

Merged
merged 45 commits into from
Oct 18, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
b41c6ae
feat: clean up code
Baroshem Sep 12, 2023
a6536a4
fix: csp for static
Baroshem Sep 12, 2023
6deb452
chore: bump nuxt-csurf to 1.3.1
Baroshem Sep 13, 2023
d9e8df8
feat: add removeLoggers functionality
Baroshem Sep 13, 2023
05c90e5
feat: add removeLoggers docs
Baroshem Sep 13, 2023
1a32f71
feat: add new rate limiter
Baroshem Sep 14, 2023
d916ce5
docs: rewrite docs to new format
Baroshem Sep 18, 2023
484d38d
feat: bug with nuxt 3.7.3
Baroshem Sep 18, 2023
aea1a97
feat: fix dependencies
Baroshem Sep 19, 2023
4df3fc2
feat: remove unused deps
Baroshem Sep 19, 2023
e1ac64f
docs: rewrite
Baroshem Sep 20, 2023
fe43ea2
feat: rate limiter unit tests
Baroshem Sep 21, 2023
75b4184
feat: readme
Baroshem Sep 21, 2023
dfacfd1
fix: remove broken test for `nonce`
trijpstra-fourlights Sep 21, 2023
006e87c
Merge pull request #213 from trijpstra-fourlights/chore/1.0.0-rc.1
Baroshem Sep 21, 2023
29766f0
docs: bump docus
Baroshem Sep 26, 2023
bf5d18e
fix: falsy values for SSG CSP
Baroshem Sep 26, 2023
40c6a72
feat: basic auth include
Baroshem Sep 28, 2023
2f12bd6
docs: add faq
Baroshem Sep 28, 2023
724186f
docs: add usage and contributing
Baroshem Sep 28, 2023
69a5755
ci: run on all pull requests and more branches
dargmuesli Sep 27, 2023
684709b
chore(defu): do not use default export
dargmuesli Sep 27, 2023
eca3a8e
chore(package): specify manager
dargmuesli Sep 29, 2023
dabab16
docs(configuration): add layer overriding instructions
dargmuesli Sep 29, 2023
d35b9c7
Merge pull request #225 from dargmuesli/package-manager
Baroshem Sep 29, 2023
c50d055
Merge pull request #224 from dargmuesli/defu
Baroshem Sep 29, 2023
2229c51
Merge pull request #226 from dargmuesli/layer-overrides
Baroshem Sep 29, 2023
68cc7af
ci: remove alpha and beta, add `rc`
dargmuesli Sep 30, 2023
6a7ff5b
Merge pull request #223 from dargmuesli/ci
Baroshem Oct 4, 2023
819fedc
docs: add headers
Baroshem Oct 6, 2023
4942b07
Merge branch 'chore/1.0.0-rc.1' of github.com:Baroshem/nuxt-security …
Baroshem Oct 6, 2023
644deee
feat: ssg script hashes support
Baroshem Oct 11, 2023
12da4ab
docs: bump yarn lock
Baroshem Oct 11, 2023
85e2425
chore: merge main
Baroshem Oct 11, 2023
d907adc
chore: update `nonce` documentation about `unsafe-inline` during deve…
trijpstra-fourlights Oct 12, 2023
14957b7
Merge pull request #240 from trijpstra-fourlights/chore/1.0.0-rc.1
Baroshem Oct 12, 2023
958b8cb
docs(headers): Add documentation for updating headers on a specific r…
fabricioOak Oct 14, 2023
5d9740a
Merge pull request #242 from fabricioOak/documentation-external-navig…
Baroshem Oct 15, 2023
9861e61
fix: permissions policy
Baroshem Oct 15, 2023
fdcdc8a
fix!: throwError for allowed Methods
Baroshem Oct 15, 2023
b9c675f
fix: unit tests for allowed methods
Baroshem Oct 15, 2023
8daff4b
chore: add @rc in the docs
Baroshem Oct 17, 2023
71fa095
docs: final docs fixes
Baroshem Oct 18, 2023
f0f3fa3
fix: inline deps
Baroshem Oct 18, 2023
a9e85b5
docs: readme changes
Baroshem Oct 18, 2023
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@ name: ci
on:
push:
branches:
- main
- 'main'
- '**-rc.**'
- 'renovate/**'
pull_request:
branches:
- main

jobs:
ci:
Expand Down
26 changes: 11 additions & 15 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,37 +1,37 @@
[![nuxt-security](https://nuxt-security.vercel.app/preview.png)](https://nuxt-security.vercel.app)

# nuxt-security

[![npm version][npm-version-src]][npm-version-href]
[![npm downloads][npm-downloads-src]][npm-downloads-href]
[![Github Actions CI][github-actions-ci-src]][github-actions-ci-href]
[![License][license-src]][license-href]
[![Nuxt][nuxt-src]][nuxt-href]

> Security module for Nuxt based on [OWASP Top 10](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#nodejs-security-cheat-sheet) and [helmet](https://helmetjs.github.io/) that adds security response headers, protection middlewares, CORS, and more.
# Nuxt Security

Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware.

> This module works with Nuxt 3 only

- [📖  Read the documentation](https://nuxt-security.vercel.app)
- [👾  Playground](https://stackblitz.com/github/baroshem/nuxt-security?file=.stackblitz%2Fnuxt.config.ts)
- [✨  Intro video](https://www.youtube.com/watch?v=8ac30Py8Ses)
- [👾  Playground](https://nuxt-security.vercel.app/playground)

## Features

- Nuxt 3 ready
- Security response headers
- Content Security Policy (CSP) for SSG apps
- Security response headers (including CSP for SSG apps)
- Request Size & Rate Limiters
- Cross Site Scripting (XSS) Validation
- Cross-Origin Resource Sharing (CORS) support
- Hide `X-Powered-By` header and remove console loggers utils
- `[Optional]` Allowed HTTP Methods, Basic Auth, CSRF

## Usage

Install the module:

```sh
npm i -D nuxt-security
yarn add -D nuxt-security
pnpm add -D nuxt-security
npm i -D nuxt-security@rc
yarn add -D nuxt-security@rc
pnpm add -D nuxt-security@rc
```

Add the module in the `modules` array in `nuxt.config.ts`:
Expand All @@ -44,10 +44,6 @@ export default defineNuxtConfig({

And that's it! The module will now register route rules and server middlewares globally so that your application will be more secured.

## Static site generation (SSG)

This module is meant to work with SSR apps, but you can also use this module in SSG apps where you will get a Content Security Policy (CSP) support via `<meta http-equiv>` tag. You can find more about configuring Content Security Policy (CSP) [here](https://nuxt-security.vercel.app/security/headers#content-security-policy).

## Configuration

You can pass configuration to the module in the `nuxt.config.ts` like following:
Expand Down
12 changes: 12 additions & 0 deletions docs/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
node_modules
*.iml
.idea
*.log*
.nuxt
.vscode
.DS_Store
coverage
dist
sw.*
.env
.output
1 change: 1 addition & 0 deletions docs/.npmrc
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
shamefully-hoist=true
41 changes: 41 additions & 0 deletions docs/app.config.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
export default defineAppConfig({
github: {
owner: 'Baroshem',
repo: 'nuxt-security',
branch: 'main'
},
docus: {
title: 'Nuxt Security',
description: '🛡️ Security Module for Nuxt based on HTTP Headers and Middleware',
image: '/preview.jpg',
url: 'https://nuxt-security.vercel.app',
socials: {
twitter: 'jacobandrewsky',
github: 'baroshem/nuxt-security',
nuxt: {
label: 'Nuxt',
icon: 'simple-icons:nuxtdotjs',
href: 'https://nuxt.com'
}
},
aside: {
level: 1
},
github: {
dir: 'docs/content',
root: 'docs/content',
edit: true,
releases: true,
owner: 'baroshem',
repo: 'nuxt-security',
branch: 'main'
},
cover: {
src: '/preview.png',
alt: 'Security Module for Nuxt based on HTTP Headers and Middleware'
},
header: {
logo: true
}
}
})
Loading
Loading