shield

Turn on the security basics every API needs: CORS, CSRF protection, safe headers and rate limits.

BackendServer

What it is

@kitr/shield adds four middlewares to the server: security headers, CORS, CSRF and rate limiting. config/shield.ts configures them; shieldMiddlewares hands them out one by one for routes with different rules.

Runs on the server only. It does not know who the user is: that is auth.

Install

kitr add shield

First time? Run npm i -g @kitr/kitr once. Inside a project, the global kitr runs your project's own version.

Adds @kitr/shield, its provider, config/shield.ts and shield(server) in server/main.ts. Adds server first if missing. Every change.

Quick start

Nothing to write. Start the server and ask for anything:

curl -i http://localhost:3001/api/health
HTTP/1.1 200 OK
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' ws: wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
permissions-policy: camera=(), microphone=(), geolocation=()
ratelimit-limit: 300
ratelimit-remaining: 299
ratelimit-reset: 60
referrer-policy: strict-origin-when-cross-origin
set-cookie: kitr-csrf=ed33bfe66a21a75f218cbf44dd6d230f0f9087dbed1c8fc0; Path=/; SameSite=Lax
x-content-type-options: nosniff
x-frame-options: DENY

A POST without the CSRF token is refused:

curl -i -X POST http://localhost:3001/api/projects
HTTP/1.1 403 Forbidden

{"code":"FORBIDDEN","message":"CSRF token missing or invalid","status":403}

Your own front end never sees that error: http sends the CSRF token for you. Tune limits and origins in config/shield.ts. Next in the guide: Protect your API.

Built on

kitr adds the defaults, the order, the config file and the per-route overrides.

Problems it solves

Further reading