Initial commit

.gitignore

@@ -0,0 +1,4 @@
+node_modules
+coverage
+*.log
+.DS_Store

.travis.yml

@@ -0,0 +1,6 @@
+language: node_js
+node_js:
+  - "4"
+sudo: false
+script: "npm run test-travis"
+after_script: "npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Pierre Brouca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,54 @@
+# Koa XFrame
+
+[![NPM version][npm-image]][npm-url]
+[![build status][travis-image]][travis-url]
+[![Test coverage][coveralls-image]][coveralls-url]
+[![David deps][david-image]][david-url]
+[![npm download][download-image]][download-url]
+
+[X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options) HTTP response header utility for Koa.
+
+__:heavy_exclamation_mark: This middleware is design around the new Koa `async (ctx, next) => middleware` signature (+/- Koa v2.0.0)__
+
+## Installation
+
+```
+$ npm install --save koa-xframe
+```
+
+## Usage & API
+
+```js
+import Koa from 'koa';
+import xFrame from 'koa-xframe';
+
+const app = new Koa();
+
+// default settings -> set X-Frame-Options to 'DENY'
+app.use(xFrame());
+
+// custom settings
+// -> set X-Frame-Options to 'DENY'
+app.use(xFrame('DENY'));
+// -> set X-Frame-Options to 'SAMEORIGIN'
+app.use(xFrame('SAMEORIGIN'));
+```
+
+## Credits
+
+Inspired by [Koala headers.js middleware](https://github.com/koajs/koala/blob/master/lib/middleware/headers.js).
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/koa-xframe.svg?style=flat-square
+[npm-url]: https://npmjs.org/package/koa-xframe
+[travis-image]:https://img.shields.io/travis/broucz/koa-xframe.svg?style=flat-square
+[travis-url]: https://travis-ci.org/broucz/koa-xframe
+[coveralls-image]: https://img.shields.io/coveralls/broucz/koa-xframe.svg?style=flat-square
+[coveralls-url]: https://coveralls.io/r/broucz/koa-xframe?branch=master
+[david-image]: https://img.shields.io/david/broucz/koa-xframe.svg?style=flat-square
+[david-url]: https://david-dm.org/broucz/koa-xframe
+[download-image]: https://img.shields.io/npm/dm/koa-xframe.svg?style=flat-square
+[download-url]: https://npmjs.org/package/koa-xframe

index.js

@@ -0,0 +1,18 @@
+const canBe = ['DENY', 'SAMEORIGIN'];
+
+const xFrame = (value = 'DENY') => {
+  if (!~canBe.indexOf(value)) {
+    throw new Error(`X-Frame-Options value '${value}' is not allowed. Expected 'DENY' or 'SAMEORIGIN'`);
+  }
+
+  return async (ctx, next) => {
+    await next();
+    // headers only necessary for HTML pages
+    const {type} = ctx;
+    if (type && ~type.indexOf('text/html')) {
+      ctx.response.set('X-Frame-Options', value);
+    }
+  }
+}
+
+export default xFrame;

package.json

@@ -0,0 +1,39 @@
+{
+  "name": "koa-xframe",
+  "version": "0.0.1",
+  "description": "X-Frame-Options HTTP response header utility for Koa",
+  "main": "index.js",
+  "scripts": {
+    "test": "NODE_ENV=test ./node_modules/.bin/_mocha --compilers js:babel/register",
+    "test-cov": "NODE_ENV=test node ./node_modules/.bin/istanbul cover ./node_modules/.bin/_mocha -- --compilers js:babel/register",
+    "test-travis": "NODE_ENV=test node ./node_modules/.bin/istanbul cover ./node_modules/.bin/_mocha --report lcovonly -- --compilers js:babel/register"
+  },
+  "author": "Pierre Brouca <pierre.brouca@icloud.com> (https://github.com/broucz)",
+  "license": "MIT",
+  "homepage": "https://github.com/broucz/koa-xframe#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/broucz/koa-xframe.git"
+  },
+  "bugs": {
+    "url": "https://github.com/broucz/koa-xframe/issues"
+  },
+  "keywords": [
+    "koa",
+    "X-Frame-Options"
+  ],
+  "devDependencies": {
+    "babel": "^5.8.23",
+    "chai": "^3.4.0",
+    "istanbul": "^0.4.0",
+    "koa": "^2.0.0 || ^2.0.0-alpha.1",
+    "mocha": "^2.3.3",
+    "supertest": "^1.1.0"
+  },
+  "engines": {
+    "node": ">= 4"
+  },
+  "files": [
+    "index.js"
+  ]
+}

scripts/release.sh

@@ -0,0 +1,39 @@
+#!/bin/bash -e
+
+: ${NPM_TAG:="latest"}
+
+update_version() {
+  echo "$(node -p "p=require('./${1}');p.version='${2}';JSON.stringify(p,null,2)")" > $1
+  echo "Updated ${1} version to ${2}"
+}
+
+validate_semver() {
+  if ! [[ $1 =~ ^[0-9]\.[0-9]+\.[0-9](-.+)? ]]; then
+    echo >&2 "Version $1 is not valid! It must be a valid semver string like 1.0.2 or 2.3.0-beta1"
+    exit 1
+  fi
+}
+
+current_version=$(node -p "require('./package').version")
+
+printf "Next version (current is $current_version)? "
+read next_version
+
+validate_semver $next_version
+
+next_ref="v$next_version"
+
+npm test
+
+update_version 'package.json' $next_version
+
+git commit -am "Version $next_version"
+
+git tag $next_ref
+
+git push origin master
+git push origin $next_ref
+
+echo "$(node -p "p=require('./package.json');JSON.stringify(p,null,2)")" > package.json
+
+npm publish . --tag $NPM_TAG

test/test.js

@@ -0,0 +1,69 @@
+import request from 'supertest';
+import {expect} from 'chai';
+import Koa from 'koa';
+import xFrame from '..';
+
+describe('koa-xframe', () => {
+  it(`should set X-Frame-Options to 'DENY' by default`, done => {
+    const app = new Koa();
+    app.use(xFrame());
+
+    app.use(async (ctx, next) => {
+      ctx.type = 'text/html';
+      await next();
+    });
+
+    request(app.listen())
+      .get('/')
+      .expect('X-Frame-Options', 'DENY')
+      .end(done);
+  });
+  it(`should set X-Frame-Options to 'DENY' if value = 'DENY'`, done => {
+    const app = new Koa();
+    app.use(xFrame('DENY'));
+
+    app.use(async (ctx, next) => {
+      ctx.type = 'text/html';
+      await next();
+    });
+
+    request(app.listen())
+      .get('/')
+      .expect('X-Frame-Options', 'DENY')
+      .end(done);
+  });
+  it(`should set X-Frame-Options to 'SAMEORIGIN' if value = 'SAMEORIGIN'`, done => {
+    const app = new Koa();
+    app.use(xFrame('SAMEORIGIN'));
+
+    app.use(async (ctx, next) => {
+      ctx.type = 'text/html';
+      await next();
+    });
+
+    request(app.listen())
+      .get('/')
+      .expect('X-Frame-Options', 'SAMEORIGIN')
+      .end(done);
+  });
+  it(`should not set X-Frame-Options if ctx -> type !== 'text/html'`, done => {
+    const app = new Koa();
+    app.use(xFrame());
+
+    app.use(async (ctx, next) => {
+      ctx.type = 'text/plain';
+      await next();
+    });
+
+    request(app.listen())
+      .get('/')
+      .end((err, res) => {
+        expect(res.headers['x-frame-options']).to.equal(undefined)
+        done(err);
+      });
+  });
+  it(`should throw if value is not allowed`, done => {
+    expect(xFrame.bind(xFrame, 'wrong_value')).to.throw(`X-Frame-Options value 'wrong_value' is not allowed. Expected 'DENY' or 'SAMEORIGIN'`)
+    return done();
+  });
+});