Node Guard

General purpose I/O module to add following http headers to keep your webpages securing them from malware attacks. This module can be used with any node http server.

• X-XSS-Protection
• X-Frame-Options
• X-Content-Type-Options
• X-Download-Options

X-XSS-Protection

X-XSS-Protection http header saves you from XSS attacks. node-guard will set up X-XSS-Protection header on all modern browsers and will disable it for older versions of IE as they have security vulnerabilities defined here https://technet.microsoft.com/library/security/ms10-002.

1const http = require('http')
2const guard = require('node-guard')
3const options = {
4  enabled: true,
5  enableOnOldIE: false
6}
7
8http.createServer(function (req, res) {
9  guard.addXssFilter(req, res, options)
10  res.end()
11}).listen(3000)

X-Frame-Options

X-Frame-Options defines whether your webpage can be embedded as an iframe to other website. It can take 3 different values from ALLOW-FROM, DENY and SAMEORIGIN

1const http = require('http')
2const guard = require('node-guard')
3const options = 'DENY' // cannot be embedded at all
4// or
5const options = 'SAMEORIGIN' // only this website
6// or
7const options = 'ALLOW-FROM http://example.com' // defined uri
8
9http.createServer(function (req, res) {
10  guard.addFrameOptions(res, options)
11  res.end()
12}).listen(3000)

X-Content-Type-Options

X-Content-Type-Options disables sniffing from web browsers, where they will try to sniff mimetypes. Which means a web browser will execute the javascript file even if the content-type of that file is not set to javascript. Give it a read https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

1const http = require('http')
2const guard = require('node-guard')
3const options = true // or false
4
5http.createServer(function (req, res) {
6  guard.addNoSniff(res, options)
7  res.end()
8}).listen(3000)

X-Download-Options

IE specific header to stop users from executing html files with the access to your site context. Here is a good read on same https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/.

1const http = require('http')
2const guard = require('node-guard')
3const options = true // or false
4
5http.createServer(function (req, res) {
6  guard.addNoOpen(res, options)
7  res.end()
8}).listen(3000)