Content Security Policy (CSP)

XyPriss provides advanced Content Security Policy configuration with flexible directive support through the Helmet middleware. This allows developers to create comprehensive security policies to prevent XSS and data injection attacks.

Basic Configuration

Configure CSP directives globally in your server options. XyPriss supports strings, arrays, and boolean directives.

typescript

import { createServer } from "xypriss";

const app = createServer({
    security: {
        helmet: {
            contentSecurityPolicy: {
                directives: {
                    defaultSrc: ["'self'"],
                    scriptSrc: ["'self'", "'unsafe-inline'"],
                    styleSrc: ["'self'", "'unsafe-inline'"],
                    imgSrc: ["'self'", "data:", "https:"],
                },
            },
        },
    },
});

Advanced Multi-Source Policy

For complex applications, you can define granular sources for different resource types:

typescript

const app = createServer({
    security: {
        helmet: {
            contentSecurityPolicy: {
                directives: {
                    defaultSrc: ["'self'"],
                    scriptSrc: [
                        "'self'",
                        "'unsafe-inline'",
                        "https://cdn.example.com",
                        "https://dll.nehonix.com"
                    ],
                    fontSrc: ["'self'", "https://fonts.gstatic.com", "data:"],
                    connectSrc: ["'self'", "https://dll.nehonix.com"],
                    frameSrc: ["'none'"],
                    objectSrc: ["'none'"],
                    upgradeInsecureRequests: [] // Boolean directive
                }
            }
        }
    }
});

Nonces and Hashes

Nonce Support

Generate per-request nonces to allow specific inline scripts while maintaining a strict policy.

Hash Support

Whiltelist specific inline script contents using their SHA-256 cryptographic hashes.

Report-Only Mode

Test new policies without blocking resources by enabling reportOnly mode. Violations will be logged to the specified URI.

typescript

const app = createServer({
    security: {
        helmet: {
            contentSecurityPolicy: {
                reportOnly: true, 
                directives: { /* directives */ },
                reportUri: "/api/security/csp-report",
            },
        },
    },
});

Development Security Profile (Automatic)

XyPriss includes a security profile specifically designed for local development. It automatically relaxes headers (CSP, COEP, CORP, HSTS) to allow development tools to function correctly (Hot Reloading, local WebSockets, CDNs).

This profile activates automatically if both of the following conditions are met:

The environment is in development mode (NODE_ENV=development).
The XSEC_TRUST environment variable is not set to "false" (it defaults to "true" in dev).

.env

NODE_ENV=development

# Optional: disable the dev profile to test strict production config
# XSEC_TRUST=false

What the development profile does

CSP: Allows requests to localhost:* and 127.0.0.1:* (HTTP and WS), plus trusted CDNs (cdnjs, jsdelivr, Google Fonts).
COEP/CORP: Relaxes Cross-Origin isolation to allow loading external resources during development.
HSTS: Disables strict HSTS caching (max-age=0) to avoid locking your browser on localhost.

A security reminder is printed in the console at each startup in dev mode. In production (NODE_ENV=production), XyPriss automatically switches back to the Zero Trust profile (strict CSP, HSTS enabled, COEP isolation).

Security Best Practices

Avoid unsafe-inline: Whenever possible, avoid using 'unsafe-inline'. Use Nonces or Hashes instead to maintain a strong security posture.

Principle of Least Privilege: Only allow necessary sources and start with restrictive defaults.
Use HTTPS: Always prefer and enforce HTTPS sources for all directives.

CORS Policy

Configure cross-origin resource sharing for your API with wildcard and pattern support.