Blockade

Blockade ⚓️ is a lightweight package that adds optional security headers and cookie attributes for Node.js web frameworks.

Security HTTP headers and cookie attributes help enhance the security of your web application by enabling built-in browser security mechanisms.

Supported Node.js web frameworks:

AdonisJs, Express, Fastify, hapi, Koa, Meteor, Nest, Polka, restify, Sails, Total.js

Install

$ npm i blockade

After installing Blockade:

constblockade=require("blockade");constsecureHeaders=newblockade.SecureHeaders();constsecureCookie=newblockade.SecureCookie();

Secure Headers

Example

secureHeaders.framework(response);

Default HTTP response headers:

Strict-Transport-Security: max-age=63072000; includeSubdomainsX-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffReferrer-Policy: no-referrer, strict-origin-when-cross-originCache-control: no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheExpires: 0

Secure Cookie

Example

secureCookie.framework(response,"foo","bar");

Default Set-Cookie HTTP response header:

Set-Cookie: foo=bar; Path=/; secure; HttpOnly; SameSite=lax

Documentation

Please see the full set of documentation at https://blockadejs.readthedocs.io

Resources

• OWASP - Secure Headers Project
• OWASP - Session Management Cheat Sheet
• Mozilla Web Security
• securityheaders.com