Opinionated defaults for API servers

[IchordeDionysos]

Hey,

the headers seem to be targeted more towards serving server-side rendered/served webpages.
While there is a use-case to lock down your pure NodeJS API servers with security headers.

I could see the following API surface using default targeted toward pure APIs:

app.use(
  helmet.apiDefaults()
)

Example headers (taken from GitHub API) could include (non-complete):

content-security-policy: default-src 'none'
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0

[EvanHahn]

It's hard to give specific advice here because applications are so different. When I've tried to make Helmet opinionated, I've regretted it.

See this comment for more details: #536 (comment)

Would something like that work for you?

[IchordeDionysos]

@EvanHahn I guess, I was searching for more (the most) restrictive defaults 🤔

[EvanHahn]

app.use(helmet()) probably offers the most restrictive defaults. Would that work for you?

[IchordeDionysos]

Well a lot of the policies do tend to allow same origin instead of denying...

The default CSP header:

default-src 'self'
  base-uri 'self'
  font-src 'self' https: data:
  form-action 'self'
  frame-ancestors 'self'
  img-src 'self' data:
  object-src 'none'
  script-src 'self'
  script-src-attr 'none'
  style-src 'self' https: 'unsafe-inline'
  upgrade-insecure-requests

[EvanHahn]

Do those defaults work for you?