[feature-request] Allow array of domains as options

[cristiandouce]

Something like:

app.use(helmet.frameguard("allow-from", ["https://domain1.com", "https://domain2.com"]))

Perhaps also a regex?

[EvanHahn]

Every spec I found showed that allow-from can only have one domain in it. Have you found something that says we can add multiple origins?

[cristiandouce]

Have you found something that says we can add multiple origins?

No. Yet it's a common dev issue I've encountered in many projects when you handle different resources.

I was thinking that it could be handled like this internally:

function frameguard (action, options) {
  // ...
  if ('allow-from' === action) {
    let allowFrom = (options.indexOf(req.hostname) >= 0 ? req.hostname : options[0];
    req.setHeader('X-Frame-Options', 'ALLOW-FROM ' + allowFrom);
  }
  // ...
}

for the case options is an array of strings. or some similar validation. I could send a working PR later if you are ok to support such feature.

[EvanHahn]

This is a good idea.

Two thoughts:

1. I've tried to shy away from Express-specific features in Helmet, and req.hostname is one of those. I haven't been able to avoid them completely (the HSTS middleware uses a property set by Express). I'm happy to do this, as long as we add a caveat: if you use allow-from with an array, you'll need to set req.hostname.
2. I'd love to make sure that this works; is req.hostname a property we can rely on? Does it have its own security issues?

I'd definitely love a pull request if you're willing.

[binarykitchen]

Yes, I need that feature too! Why the wait?

[cristiandouce]

I've managed to create a PR with this feature. I've been trying to fix the tests. But current impl is not very informative. I could use some help figuring out what is going on with the last 2.

[cristiandouce]

  15 passing (100ms)
  2 failing
     AssertionError: Missing expected exception..
      at _throws (assert.js:337:5)
      at Function.assert.throws (assert.js:361:3)
      at Context.<anonymous> (test/index.js:140:14)
  2) frameguard with improper input fails with a bad domain if the action is "ALLOW-FROM":
     AssertionError: Missing expected exception..
      at _throws (assert.js:337:5)
      at Function.assert.throws (assert.js:361:3)
      at Context.<anonymous> (test/index.js:155:14)

[cristiandouce]

Found it! n/m. PR is ready for review 👯

[EvanHahn]

Those assertion errors should be made more informative.

Could you submit the PR and I'll take a look, even if it's incomplete?

[cristiandouce]

@EvanHahn It's passing green now! 😄

[EvanHahn]

Thanks! I'll take a look soon.

[EvanHahn]

Closing in favor of #12.