Skip to content

Commit

Permalink
Merge pull request #249 from olin-build/osteele/security
Browse files Browse the repository at this point in the history 
Add option to ENFORCE_SSL
  • Loading branch information
@osteele
osteele committed Jun 4, 2018
2 parents 7478404 + e8d85c5 commit 5bcfb28
Show file tree
Hide file tree
Showing 3 changed files with 113 additions and 8 deletions.
6 changes: 5 additions & 1 deletion package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@
"expose": "^0.1.4",
"expose-loader": "^0.7.3",
"express": "^4.15.3",
"helmet": "^3.12.1",
"http-server": "0.10.0",
"input-moment": "git+https://github.com/kylecombes/input-moment.git",
"lodash": "^4.17.10",
Expand Down Expand Up @@ -97,7 +98,10 @@
"webpack-dev-server": "^2.5.0"
},
"jest": {
"coveragePathIgnorePatterns": ["/node_modules/","__test__"],
"coveragePathIgnorePatterns": [
"/node_modules/",
"__test__"
],
"moduleNameMapper": {
"\\.(svg)$": "<rootDir>/__mocks__/fileMock.js"
},
Expand Down
24 changes: 17 additions & 7 deletions server.js
View file
Original file line number Diff line number Diff line change
@@ -1,10 +1,20 @@
const fs = require('fs');
const bodyParser = require('body-parser');
const express = require('express');
const helmet = require('helmet');

const PORT = process.env.PORT || 8080;
const { ENFORCE_SSL } = process.env;

const app = express();
const bodyParser = require('body-parser');

const port = process.env.PORT || 8080;
const fs = require('fs');
app.use(helmet({
hsts: false,
}));
if (ENFORCE_SSL) {
app.use((req, res, next) =>
(req.secure ? next() : res.redirect(`https://${req.get('Host')}${req.url}`)));
}

app.use(bodyParser.json({ type: 'application/*+json' }));
app.use(express.static(__dirname));
Expand Down Expand Up @@ -33,11 +43,11 @@ app.get('*', (req, res) => {
res.send(html);
});

const server = app.listen(port, () => {
let host = server.address().address;
const server = app.listen(PORT, () => {
const { address, port } = server.address();
// replace IPv6 wildcard by a recognizable URL, that can be used in a browser
// address bar
host = host.replace(/^::$/, '0.0.0.0');
const host = address.replace(/^::$/, '0.0.0.0');
// Printed thus, some terminals display a clickable link
console.log('Dev server is listening at http://%s:%s/', host, server.address().port);
console.log(`Dev server is listening at http://${host}:${port}/`);
});
91 changes: 91 additions & 0 deletions yarn.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1647,6 +1647,10 @@ camelcase@^4.0.0:
version "4.1.0"
resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-4.1.0.tgz#d545635be1e33c542649c69173e5de6acfae34dd"

camelize@1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/camelize/-/camelize-1.0.0.tgz#164a5483e630fa4321e5af07020e531831b2609b"

caniuse-api@^1.5.2:
version "1.6.1"
resolved "https://registry.yarnpkg.com/caniuse-api/-/caniuse-api-1.6.1.tgz#b534e7c734c4f81ec5fbe8aca2ad24354b962c6c"
Expand Down Expand Up @@ -2034,6 +2038,10 @@ content-disposition@0.5.2:
version "0.5.2"
resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.2.tgz#0cf68bb9ddf5f2be7961c3a85178cb85dba78cb4"

content-security-policy-builder@2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/content-security-policy-builder/-/content-security-policy-builder-2.0.0.tgz#8749a1d542fcbe82237281ea9f716ce68b394dd2"

content-type-parser@^1.0.1:
version "1.0.2"
resolved "https://registry.yarnpkg.com/content-type-parser/-/content-type-parser-1.0.2.tgz#caabe80623e63638b2502fd4c7f12ff4ce2352e7"
Expand Down Expand Up @@ -2335,6 +2343,10 @@ dashdash@^1.12.0:
dependencies:
assert-plus "^1.0.0"

dasherize@2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/dasherize/-/dasherize-2.0.0.tgz#6d809c9cd0cf7bb8952d80fc84fa13d47ddb1308"

date-now@^0.1.4:
version "0.1.4"
resolved "https://registry.yarnpkg.com/date-now/-/date-now-0.1.4.tgz#eaf439fd4d4848ad74e5cc7dbef200672b9e345b"
Expand Down Expand Up @@ -2522,6 +2534,10 @@ dns-packet@^1.0.1:
ip "^1.1.0"
safe-buffer "^5.0.1"

dns-prefetch-control@0.1.0:
version "0.1.0"
resolved "https://registry.yarnpkg.com/dns-prefetch-control/-/dns-prefetch-control-0.1.0.tgz#60ddb457774e178f1f9415f0cabb0e85b0b300b2"

dns-txt@^2.0.2:
version "2.0.2"
resolved "https://registry.yarnpkg.com/dns-txt/-/dns-txt-2.0.2.tgz#b91d806f5d27188e4ab3e7d107d881a1cc4642b6"
Expand Down Expand Up @@ -2604,6 +2620,10 @@ domutils@^1.5.1:
dom-serializer "0"
domelementtype "1"

dont-sniff-mimetype@1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/dont-sniff-mimetype/-/dont-sniff-mimetype-1.0.0.tgz#5932890dc9f4e2f19e5eb02a20026e5e5efc8f58"

dot-prop@^4.1.0:
version "4.2.0"
resolved "https://registry.yarnpkg.com/dot-prop/-/dot-prop-4.2.0.tgz#1f19e0c2e1aa0e32797c49799f2837ac6af69c57"
Expand Down Expand Up @@ -3223,6 +3243,10 @@ expand-tilde@^2.0.0, expand-tilde@^2.0.2:
dependencies:
homedir-polyfill "^1.0.1"

expect-ct@0.1.1:
version "0.1.1"
resolved "https://registry.yarnpkg.com/expect-ct/-/expect-ct-0.1.1.tgz#de84476a2dbcb85000d5903737e9bc8a5ba7b897"

expose-loader@^0.7.3:
version "0.7.4"
resolved "https://registry.yarnpkg.com/expose-loader/-/expose-loader-0.7.4.tgz#9bcdd3878b5da9107930b55a03f65afe90b3314a"
Expand Down Expand Up @@ -3609,6 +3633,10 @@ fragment-cache@^0.2.1:
dependencies:
map-cache "^0.2.2"

frameguard@3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/frameguard/-/frameguard-3.0.0.tgz#7bcad469ee7b96e91d12ceb3959c78235a9272e9"

fresh@0.5.2:
version "0.5.2"
resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7"
Expand Down Expand Up @@ -4001,6 +4029,37 @@ he@1.1.x, he@^1.1.1:
version "1.1.1"
resolved "https://registry.yarnpkg.com/he/-/he-1.1.1.tgz#93410fd21b009735151f8868c2f271f3427e23fd"

helmet-csp@2.7.0:
version "2.7.0"
resolved "https://registry.yarnpkg.com/helmet-csp/-/helmet-csp-2.7.0.tgz#7934094617d1feb7bb2dc43bb7d9e8830f774716"
dependencies:
camelize "1.0.0"
content-security-policy-builder "2.0.0"
dasherize "2.0.0"
lodash.reduce "4.6.0"
platform "1.3.5"

helmet@^3.12.1:
version "3.12.1"
resolved "https://registry.yarnpkg.com/helmet/-/helmet-3.12.1.tgz#8b05bbd60f3966d70f13dad0de2c1d6c1a8303f1"
dependencies:
dns-prefetch-control "0.1.0"
dont-sniff-mimetype "1.0.0"
expect-ct "0.1.1"
frameguard "3.0.0"
helmet-csp "2.7.0"
hide-powered-by "1.0.0"
hpkp "2.0.0"
hsts "2.1.0"
ienoopen "1.0.0"
nocache "2.0.0"
referrer-policy "1.1.0"
x-xss-protection "1.1.0"

hide-powered-by@1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/hide-powered-by/-/hide-powered-by-1.0.0.tgz#4a85ad65881f62857fc70af7174a1184dccce32b"

history@^4.7.2:
version "4.7.2"
resolved "https://registry.yarnpkg.com/history/-/history-4.7.2.tgz#22b5c7f31633c5b8021c7f4a8a954ac139ee8d5b"
Expand Down Expand Up @@ -4057,6 +4116,14 @@ hpack.js@^2.1.6:
readable-stream "^2.0.1"
wbuf "^1.1.0"

hpkp@2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/hpkp/-/hpkp-2.0.0.tgz#10e142264e76215a5d30c44ec43de64dee6d1672"

hsts@2.1.0:
version "2.1.0"
resolved "https://registry.yarnpkg.com/hsts/-/hsts-2.1.0.tgz#cbd6c918a2385fee1dd5680bfb2b3a194c0121cc"

html-comment-regex@^1.1.0:
version "1.1.1"
resolved "https://registry.yarnpkg.com/html-comment-regex/-/html-comment-regex-1.1.1.tgz#668b93776eaae55ebde8f3ad464b307a4963625e"
Expand Down Expand Up @@ -4204,6 +4271,10 @@ ieee754@^1.1.4:
version "1.1.8"
resolved "https://registry.yarnpkg.com/ieee754/-/ieee754-1.1.8.tgz#be33d40ac10ef1926701f6f08a2d86fbfd1ad3e4"

ienoopen@1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/ienoopen/-/ienoopen-1.0.0.tgz#346a428f474aac8f50cf3784ea2d0f16f62bda6b"

ignore@^3.2.0, ignore@^3.3.3:
version "3.3.7"
resolved "https://registry.yarnpkg.com/ignore/-/ignore-3.3.7.tgz#612289bfb3c220e186a58118618d5be8c1bab021"
Expand Down Expand Up @@ -5291,6 +5362,10 @@ lodash.memoize@^4.1.2:
version "4.1.2"
resolved "https://registry.yarnpkg.com/lodash.memoize/-/lodash.memoize-4.1.2.tgz#bcc6c49a42a2840ed997f323eada5ecd182e0bfe"

lodash.reduce@4.6.0:
version "4.6.0"
resolved "https://registry.yarnpkg.com/lodash.reduce/-/lodash.reduce-4.6.0.tgz#f1ab6b839299ad48f784abbf476596f03b914d3b"

lodash.template@^4.4.0:
version "4.4.0"
resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.4.0.tgz#e73a0385c8355591746e020b99679c690e68fba0"
Expand Down Expand Up @@ -5733,6 +5808,10 @@ no-case@^2.2.0:
dependencies:
lower-case "^1.1.1"

nocache@2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/nocache/-/nocache-2.0.0.tgz#202b48021a0c4cbde2df80de15a17443c8b43980"

node-fetch@^1.0.1:
version "1.7.3"
resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-1.7.3.tgz#980f6f72d85211a5347c6b2bc18c5b84c3eb47ef"
Expand Down Expand Up @@ -6260,6 +6339,10 @@ pkg-up@^1.0.0:
dependencies:
find-up "^1.0.0"

platform@1.3.5:
version "1.3.5"
resolved "https://registry.yarnpkg.com/platform/-/platform-1.3.5.tgz#fb6958c696e07e2918d2eeda0f0bc9448d733444"

pluralize@^1.2.1:
version "1.2.1"
resolved "https://registry.yarnpkg.com/pluralize/-/pluralize-1.2.1.tgz#d1a21483fd22bb41e58a12fa3421823140897c45"
Expand Down Expand Up @@ -7175,6 +7258,10 @@ redux@^3.7.1, redux@^3.7.2:
loose-envify "^1.1.0"
symbol-observable "^1.0.3"

referrer-policy@1.1.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/referrer-policy/-/referrer-policy-1.1.0.tgz#35774eb735bf50fb6c078e83334b472350207d79"

regenerate@^1.2.1:
version "1.3.3"
resolved "https://registry.yarnpkg.com/regenerate/-/regenerate-1.3.3.tgz#0c336d3980553d755c39b586ae3b20aa49c82b7f"
Expand Down Expand Up @@ -8943,6 +9030,10 @@ write@^0.2.1:
dependencies:
mkdirp "^0.5.1"

x-xss-protection@1.1.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/x-xss-protection/-/x-xss-protection-1.1.0.tgz#4f1898c332deb1e7f2be1280efb3e2c53d69c1a7"

xdg-basedir@^3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/xdg-basedir/-/xdg-basedir-3.0.0.tgz#496b2cc109eca8dbacfe2dc72b603c17c5870ad4"
Expand Down

0 comments on commit 5bcfb28

Please sign in to comment.