brokenhandsio / vaporsecurityheaders Goto Github PK

I maintain a similar module for Node.js and decided to disable the X-XSS-Protection header based on discussion here: helmetjs/helmet#230. In short, it seems to be safer to disable it.

This would probably be a breaking change, but is this something you would consider for this package?

Current the CSP builder doesn't support child-src - it should!

The HTTPSRedirectMiddleware may be vulnerable to a Host header injection attack.

I'm not sure of the best way to solve this. One way could be to copy Django's ALLOWED_HOSTS setting.

Since ContentSecurityPolicy is a class and the various functions affect the store policies, they should all be marked with @discardableResult. This allows you to do things like:

let csp = ContentSecurityPolicy = ContentSecurityPolicy().defaultSrc("self")

if env == .production {
  csp.blockAllMixedContent()
}

This currently works but produces a warning since you aren't using the result of blockAllMixedContent.