diff --git a/README.md b/README.md index 1f90a64..e047b0f 100644 --- a/README.md +++ b/README.md @@ -62,7 +62,7 @@ export const handle = sequence( headers: { ... } - }), + }).handle, yourOtherHandle ); ``` @@ -78,9 +78,9 @@ import { securityHeaders } from '@islamzaoui/securekit'; export const handle = securityHeaders({ headers: { 'Access-Control-Allow-Origin': 'https://yoursite.com', - 'x-sveltekit-page': null, // this will be deleted + 'x-sveltekit-page': null, // this will be deleted from response haeders }, -}); +}).handle; ``` ## Content Security Policy header @@ -98,6 +98,9 @@ your can use `csp` option in `securityHeaders` to set the `Content-Security-Poli import { securityHeaders } from '@islamzaoui/securekit'; export const handle = securityHeaders({ + headers:{ + ... + }, csp: { directives: { 'script-src': ["'self'",'https://example.com'], diff --git a/apps/demo/src/app.html b/apps/demo/src/app.html index 8b66c36..7893425 100644 --- a/apps/demo/src/app.html +++ b/apps/demo/src/app.html @@ -8,6 +8,6 @@ %sveltekit.head% -
%sveltekit.body%
+
%sveltekit.body%
diff --git a/apps/demo/src/hooks.server.ts b/apps/demo/src/hooks.server.ts index 0e32ebd..ddae161 100644 --- a/apps/demo/src/hooks.server.ts +++ b/apps/demo/src/hooks.server.ts @@ -13,18 +13,18 @@ export const handle = securityHeaders({ directives: { 'base-uri': ["'self'"], 'child-src': ["'self'"], - 'connect-src': ["'self'", 'ws://localhost:*'], + 'connect-src': ["'self'", 'ws://localhost:*', "wss://ws-us3.pusher.com", "https://sockjs-us3.pusher.com"], 'img-src': ["'self'", 'data:'], 'font-src': ["'self'", 'data:'], 'form-action': ["'self'"], 'frame-ancestors': ["'self'"], - 'frame-src': ["'self'"], + 'frame-src': ["'self'", 'https://vercel.live'], 'manifest-src': ["'self'"], 'media-src': ["'self'", 'data:'], 'object-src': ["'none'"], - 'style-src': ["'self'"], + 'style-src': ["'self'", "'unsafe-inline'", "https://vercel.live"], 'default-src': ["'self'", origin], - 'script-src': ["'self'"], + 'script-src': ["'self'", 'https://vercel.live'], 'worker-src': ["'self'"] } },