put these lines in your server.js
var koa = require('koa');
var path = require('path');
var koaApp = module.exports = koa();
var config = require('./config');
var App = require('js-stack').app;
var app = new App(koaApp);
app.connectToMongoose(config.mongooseUri);
app.addDynamicViewMiddleware(path.join(config.root, '/views'), config.env === 'development');
app.addStaticContentMiddleware(path.join(config.root, '/assets'));
app.addHookMiddleware();
app.loadControllers(path.join(config.root, 'controllers'));
app.loadModels(path.join(config.root, 'models'));
if (!module.parent) { app.listen(config.port); }
var cors = require('koa-cors');
var app = new App(koaApp);
app.addMiddleware(cors());
var masEmailAddress = require('js-stack').lib.maskEmailAddress;
masEmailAddress('test@gmail.com');
var realIpAddress = require('js-stack').lib.realIpAddress;
realIpAddress(request);
var ControllerFactory = require('js-stack.lib.controllerFactory');
module.exports = ControllerFactory.create(function(router) {
router.get('/', ControllerFactory.load('main/actions/get'));
router.get('/healthcheck', ControllerFactory.load('main/actions/healthcheck/get'));
router.get('/list', ControllerFactory.loadByAcceptType('main/actions/list/get'));
});
Provides middlewares for setting up various security related HTTP headers.
var app = new App(koaApp);
app.addSecurityMiddlewares();
Sample configuration with default values:
var app = new App(koaApp);
app.addSecurityMiddlewares({
csp: {
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'"],
styleSrc: ["'self'"],
imgSrc: ["'self'"],
frameAncestors: ["'self'"],
reportUri: 'about:blank'
},
reportOnly: true
},
hsts: {
maxAge: 30,
includeSubdomains: true,
preload: false
},
useXssFilter: true,
useNoSniff: true
});
- csp: See helmetjs CSP middleware, CSP quick reference
- hsts: See helmetjs HSTS middleware, OWASP HSTS page
- xss: See helmetjs X-XSS-Protection middleware
- noSniff: See helmetjs "Don't infer the MIME type" middleware
To enable HTTPS support, simple create SERVE_HTTPS
environment variable with value true
.
The port for https will be the port of the application increased with 10000 (10k).
If you want to serve the requests with your own SSL certification, create HTTPS_KEY
and HTTPS_CERT
environment variables with path of the files as values.
export SERVE_HTTPS=true
export HTTPS_KEY="path/to/cert.key"
export HTTPS_CERT="path/to/cert.crt"
node server.js
Add the koa-ssl middlware:
var app = new App(koaApp);
app.addEnforceSSLMiddleware();
If your application is running behind reverse proxy you should set the trustProxy configiration option for detecting the x-forwarded-proto header.
var app = new App(koaApp);
app.addEnforceSSLMiddleware({ trustProxy: true });
If you use this middleware this middleware should be the first you add.