@galaxy-stack/orbit-security

Mô tả

Module bảo mật cho Orbit với Helmet middleware, CSRF protection và Crypto utilities.

Tính năng chính

1. Helmet Middleware

Tự động set các security headers:

import { HelmetMiddleware } from '@galaxy-stack/orbit-security';

// Global middleware
app.use(HelmetMiddleware());

Headers được set:

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• X-XSS-Protection: 1; mode=block
• Strict-Transport-Security: max-age=31536000; includeSubDomains
• Content-Security-Policy: default-src 'self'

2. CSRF Protection

import { CsrfMiddleware, CsrfGuard, CsrfToken } from '@galaxy-stack/orbit-security';

// Middleware to generate token
app.use(CsrfMiddleware());

@Controller('forms')
class FormController {
  @Get('token')
  getToken(@CsrfToken() token: string) {
    return { csrfToken: token };
  }

  @Post('submit')
  @UseGuards(CsrfGuard)
  submitForm(@Body() data: any) {
    return { success: true };
  }
}

3. Crypto Utilities

import { CryptoService } from '@galaxy-stack/orbit-security';

const crypto = new CryptoService();

// Encryption
const encrypted = await crypto.encrypt('secret data', 'my-key');
const decrypted = await crypto.decrypt(encrypted, 'my-key');

// Hashing
const hash = await crypto.hash('data');
const isValid = await crypto.verify('data', hash);

// Random
const randomBytes = crypto.randomBytes(32);
const randomString = crypto.randomString(16);
const uuid = crypto.uuid();

Cấu hình Module

import { SecurityModule } from '@galaxy-stack/orbit-security';

@Module({
  imports: [
    SecurityModule.forRoot({
      helmet: {
        contentSecurityPolicy: {
          directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "'unsafe-inline'"],
          },
        },
        frameguard: { action: 'deny' },
      },
      csrf: {
        enabled: true,
        tokenKey: '_csrf',
        cookieName: 'XSRF-TOKEN',
      },
    }),
  ],
})
class AppModule {}

Helmet Options

interface HelmetOptions {
  contentSecurityPolicy?: CSPOptions | boolean;
  crossOriginEmbedderPolicy?: boolean;
  crossOriginOpenerPolicy?: { policy: string };
  crossOriginResourcePolicy?: { policy: string };
  dnsPrefetchControl?: { allow: boolean };
  frameguard?: { action: 'deny' | 'sameorigin' };
  hidePoweredBy?: boolean;
  hsts?: { maxAge: number; includeSubDomains: boolean };
  ieNoOpen?: boolean;
  noSniff?: boolean;
  originAgentCluster?: boolean;
  permittedCrossDomainPolicies?: boolean;
  referrerPolicy?: { policy: string };
  xssFilter?: boolean;
}

CORS Configuration

import { CorsMiddleware } from '@galaxy-stack/orbit-security';

app.use(CorsMiddleware({
  origin: ['https://example.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400,
}));

Rate Limiting Integration

import { SecurityModule } from '@galaxy-stack/orbit-security';
import { ThrottlerModule } from '@galaxy-stack/orbit-throttler';

@Module({
  imports: [
    SecurityModule.forRoot({}),
    ThrottlerModule.forRoot({ ttl: 60, limit: 100 }),
  ],
})
class AppModule {}