fastify / fastify/help

helmet contentSecurityPolicy directives depending on req.query

Open
#849 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
68
Forks
8
Avg merge
11h 2m
Merged PRs (30d)
2

Description

#### You have already researched for similar issues?
yes

#### What are you trying to achieve, or the steps to reproduce?
Need to set helmet contentSecurityPolicy directives depending on req.query
only if req.query.parent is set, and set directive to this value

```js
fastify
.register(helmet,
{
contentSecurityPolicy: {
directives: {
frameAncestors: [`${req.query.parent}.mydomain.com`, `domainB.com`],
}
}
}
```

#### Context

I don't know what syntax to use to set a dynamic directives value depending on `req.query`

This is a static value:
```
fastify.register(
helmet,
{
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'", 'default.com'],
...etc...
},
}
}
)
```

and this sets `res` value
```
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
scriptSrc: [
function (req, res) {
// "res" here is actually "reply.raw" in fastify
res.scriptNonce = crypto.randomBytes(16).toString('hex')
}
],
```

Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.