perf: retirar dependência 'helmet'

PauloGoncalvesBH · PauloGoncalvesBH · commit 8f4d1e0b69c7 · 2020-06-11T16:25:02.000-03:00
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -41,7 +41,6 @@
     "express": "^4.17.1",
     "express-query-int": "^3.0.0",
     "express-validation": "^3.0.2",
-    "helmet": "^3.22.0",
     "jsonwebtoken": "^8.5.1",
     "morgan": "^1.10.0",
     "nedb": "^1.8.0",
diff --git a/src/app.js b/src/app.js
@@ -1,7 +1,6 @@
 'use strict'
 
 const express = require('express')
-const helmet = require('helmet')
 const logger = require('morgan')
 const queryParser = require('express-query-int')
 const timeout = require('connect-timeout')
@@ -15,8 +14,18 @@ app.use(express.urlencoded({ extended: false }))
 app.use(queryParser())
 app.use(timeout())
 
-if (conf.utilizarHeaderDeSeguranca) {
-  app.use(helmet())
+if (!conf.semHeaderDeSeguranca) {
+  app.disable('x-powered-by')
+  app.use((req, res, next) => {
+    res.set('x-dns-prefetch-control', 'off')
+    res.set('x-frame-options', 'SAMEORIGIN')
+    res.set('strict-transport-security', 'max-age=15552000; includeSubDomains')
+    res.set('x-download-options', 'noopen')
+    res.set('x-content-type-options', 'nosniff')
+    res.set('x-xss-protection', '1; mode=block')
+    res.set('content-type', 'application/json; charset=utf-8')
+    next()
+  })
 }
 
 app.use(logger('dev'))
diff --git a/src/server.js b/src/server.js
@@ -42,7 +42,7 @@ const argv = require('yargs')
   .argv
 
 conf.tokenTimeout = argv.timeout
-conf.utilizarHeaderDeSeguranca = !argv.nosec
+conf.semHeaderDeSeguranca = argv.nosec
 conf.semBearer = argv.nobearer
 const DEFAULT_PORT = 3000
 
diff --git a/test/outros/seguranca.test.js b/test/outros/seguranca.test.js
@@ -0,0 +1,34 @@
+const chai = require('chai')
+const joi = require('@hapi/joi')
+
+describe('SEGURANÇA', () => {
+  it('Validar presença de headers de segurança', async () => {
+    const rotas = ['/produtos', '/usuarios', '/carrinhos']
+    const rotaAleatoria = rotas[Math.floor(Math.random() * rotas.length)]
+    const { headers } = await request.get(rotaAleatoria).expect(200)
+
+    chai.assert.include(headers, {
+      'x-dns-prefetch-control': 'off',
+      'x-frame-options': 'SAMEORIGIN',
+      'strict-transport-security': 'max-age=15552000; includeSubDomains',
+      'x-download-options': 'noopen',
+      'x-content-type-options': 'nosniff',
+      'x-xss-protection': '1; mode=block',
+      'content-type': 'application/json; charset=utf-8'
+    })
+
+    joi.assert(headers, joi.object().keys({
+      'x-dns-prefetch-control': joi.any(),
+      'x-frame-options': joi.any(),
+      'strict-transport-security': joi.any(),
+      'x-download-options': joi.any(),
+      'x-content-type-options': joi.any(),
+      'x-xss-protection': joi.any(),
+      'content-type': joi.any(),
+      'content-length': joi.any(),
+      etag: joi.any(),
+      date: joi.any(),
+      connection: joi.any()
+    }).required())
+  })
+})
