@cvo/plugin-security

Essential security plugin for CVO Framework providing CORS, Rate Limiting, and Security Headers (Helmet).

🚀 Features

• CORS Management: Flexible configuration for Cross-Origin Resource Sharing.
• Rate Limiting: Protect your API from brute-force and DDoS attacks by limiting request frequency per IP.
• Security Headers (Helmet): Automatically sets standard security headers like X-Frame-Options, Content-Security-Policy, etc.
• Lightweight: Minimalist implementation with built-in memory-based rate limit tracking.

🛠 Configuration

Register the plugin in your cvo.config.ts:

import { defineConfig } from '@cvo/core';
import { SecurityPlugin } from '@cvo/plugin-security';

export default defineConfig({
  plugins: [
    new SecurityPlugin({
      cors: {
        origin: ['https://myapp.com'],
        methods: ['GET', 'POST']
      },
      rateLimit: {
        windowMs: 15 * 60 * 1000, // 15 minutes
        max: 100                  // Max requests per IP per windowMs
      },
      helmet: true // Enable security headers
    })
  ]
});

🧠 Security Headers

When helmet is enabled (default), the plugin sets the following headers:

• X-Content-Type-Options: nosniff: Prevents MIME type sniffing.
• X-Frame-Options: DENY: Prevents clickjacking by disallowing embedding in iframes.
• X-XSS-Protection: 1; mode=block: Enables browser XSS filtering.
• Strict-Transport-Security: Forces HTTPS connections.
• Content-Security-Policy: Default set to 'self' to allow only same-origin resources.

📊 Rate Limit Response

When a user exceeds the limit, the API returns a 429 Too Many Requests status:

{
  "error": "Too Many Requests",
  "retryAfter": 845
}