Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow customization of hapi route options #137

Open
abillingsley opened this issue Apr 1, 2019 · 0 comments
Open

Allow customization of hapi route options #137

abillingsley opened this issue Apr 1, 2019 · 0 comments

Comments

@abillingsley
Copy link

For security reasons, I would like the swagger ui to include a content security policy. To do this we can use a hapi plugin called blankie.

The following is a plugin configuration and is applied globally to all routes

{
    plugin: require("blankie"),
    options: {
      fontSrc: ["self", "fonts.gstatic.com", "data:"],
      styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
      scriptSrc: ["self", "unsafe-inline"],
      imgSrc: ["self", "data:"],
      generateNonces: false,
    },
  }

Rather than applying this configuration globally I would like to configure the blankie plugin at the route level so the content security policy is defined as strictly as possible

This is achievable in the hapi ecosystem by the plugins route option

{
   ...
   plugins: {
      blankie: {
        fontSrc: ["self", "fonts.gstatic.com", "data:"],
        styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
        scriptSrc: ["self", "unsafe-inline"],
        imgSrc: ["self", "data:"],
        generateNonces: false,
      }
   },
}

it would be ideal if the hapi-swaggered-ui plugin options exposed a mechanism to control the route options

for example

{
    plugin: require("hapi-swaggered-ui"),
    options: {
      title: "My Documentation",
      path: "/documentation",
      swaggerOptions: {
        docExpansion: "list",
      },
      routeOptions: {
        ...anyOtherValidRouteOptions
        plugins: {
          blankie: {
            fontSrc: ["self", "fonts.gstatic.com", "data:"],
            styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
            scriptSrc: ["self", "unsafe-inline"],
            imgSrc: ["self", "data:"],
            generateNonces: false,
          }
        },
      },
    },
  }

This would not only enable my specific use case about control route specific plugins but would also allow any other customization of the route configuration that users of this plugin may desire.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant